On Wed, 11 Jul 2001 12:42:55 -0400, Gilles Frydman <[log in to unmask]> wrote:

>after noticing some unusual activity from a specific
>email address:  [log in to unmask]

This is the "activity" I noticed on my server today:

(The list is set to Subscription= Open,Confirm)

11 Jul 2001 12:09:44 Processing file 0256 from [log in to unmask]
11 Jul 2001 12:09:44 From [log in to unmask]: subscribe gateway-info Zed A.
Smith
11 Jul 2001 12:09:45 Requesting confirmation, cookie=FC12BB2C
11 Jul 2001 12:09:45 Sent information mail to [log in to unmask]
11 Jul 2001 12:16:50 Processing file 0258 from [log in to unmask]
11 Jul 2001 12:16:50 From [log in to unmask]: ok fc12bb2c
11 Jul 2001 12:16:50 From [log in to unmask]: SUBSCRIBE GATEWAY-INFO Zed A.
Smith
11 Jul 2001 12:16:50 To   [log in to unmask]: You have been added to the
GATEWAY-INFO list.
11 Jul 2001 12:16:50 Sent information mail to [log in to unmask]
11 Jul 2001 12:16:50 Sending WELCOME message to [log in to unmask]
11 Jul 2001 12:16:50 Sent information mail to [log in to unmask]
11 Jul 2001 12:16:50 Sent information mail to [log in to unmask]
11 Jul 2001 12:16:50 Sent information mail to [log in to unmask]
11 Jul 2001 12:20:02 Processing file 0263 from [log in to unmask]
11 Jul 2001 12:20:02 From [log in to unmask]: SET gateway-info MAIL NODIG
NOIND NOREPRO NOACK
11 Jul 2001 12:20:02 Sent information mail to [log in to unmask]

Note that the address (script of some kind) was able to subscribe, negotiate the
OK/confirm, then do a SET command after receiving the 'welcome' notice.

The address was also able to join another list with Subscription= By_Owner , and
aside from the delay while the Owner had to add them, once the ADD was
completed, the same SET command came in about 3 minutes later.  

Pretty interesting programming for a script...