I was clearing out an old email address a couple of years ago when I spotted a message from a woman I didn’t know. She had been talking to a man online and had become suspicious of his identity. When she did a search on his profile picture, my name came up. She sent me a link to a Google+ account that had my photo and somebody else’s name, but I couldn’t see much else. I had never been particularly strict with online privacy, so I thanked her and reported it to Google+. It didn’t seem like a big deal.

Things got weirder when she invited me to join a Facebook group: 20 young women – who had all been talking online to a man called “Paul Green” – were trying to figure out his true identity. They were sharing his profile pictures and the photos he’d emailed them. They were all of me. He’d cropped my new baby niece out of a very recent photo. There was one of me from school, fooling around with a piano keyboard on my head; it was so old I’d forgotten it. It must have been from my deleted Myspace account.

He had talked to these women on teenage forums, dating sites, Facebook, Twitter, Google… and from multiple email addresses. Some had spoken to him on Skype – without video. One girl forwarded me email after email of their conversations. They had been talking for four years. They’d told each other, “I love you.” He said that – like me – he was 22. The young women ranged in age from mid-teens to early 20s. He’d talked of sending them gifts and persuaded some to send pictures back. One message read, “Thank you for those photos, my body shivered a little.” It was creepy.

He came across as intelligent. He liked poetry and literature, and spoke Spanish. He had gained their trust and some of them thought they were in a relationship with him. One said to me, “Oh, it was you we’ve been talking to.” But I had to say, “No. Not at all. These aren’t my interests. This is not me.”

I went to the police, but they weren’t interested. The law doesn’t cover you to protect your face. And it was apparent, from the messages that were shared with me, that he hadn’t done anything illegal. It took three months just to get my picture removed from his Facebook account – it would take years to contact all the sites. I mentioned my situation on Twitter: some people thought I should be flattered; for me, it was horrifying. Then I received an email that appeared to be from Paul Green’s doctor. It said that using my photos was “totally unacceptable whatever his state of mind; he knows it and apologises profusely… He will not cause you further problems.” It was from the same IP address as Paul Green’s emails. I didn’t reply.

I worried at times. My address and my parents’ address were online. What if one of the girls’ friends or family members had found those emails and decided to come after me? Or if I bumped into a girl who recognised me and thought we were in love? Some months later, the woman who had first contacted me said she’d hacked into one of Paul Green’s dating accounts and uncovered his real identity. He was 66, married, and living in Spain, having emigrated from the UK. She found his real name. She told him she knew who he was, and he apologised for what he had done and said that he was just a sad old man.

For her it was over, but I still felt the police should investigate. After I tweeted this, I received an email from him, begging me not to ruin his life; that he was lonely and dying. He hinted that if I published his identity, he would sue me. I was angry, because he probably had more legal backing than me.

I owe many positive life experiences to the internet – I met one of my best friends and my ex-boyfriend through a flight simulator gaming group. And I won’t let this experience change how I am online. But I do wish ordinary people could verify their identity the way celebrities can on Twitter. You always think that somebody is going to steal your credit card details online. You never suspect anyone is going to steal your face.

• As told to Candice Pires.

Do you have an experience to share? Email experience@theguardian.com.