I was one of the lucky ones who issued SERVE-off command after first
early-morning message arrived.  During day I received approx 42 notices
from my listserv "Mail received from user who has been served out"
as attempted postings to our non-confidential lists arrived.
 
What confuses me is that I also got (as postmast, from our MAILER ? )
about 35 other items.  When I first entered MAIL, they items showed as
 
From:                      Subj:                               Size:
 
actuary@<local listname>   Court Ordered Liquidation - C        129
 
where <local listname> cycled thru about 15 of our local listnames
with several multiple occurances.  After opening/reading some of
these items, the From/To info sometimes changed to indicate
internet listnames.  Did anyone do a detail dump of the envelope
of any of these postings ?  I mean, while I could see stuff bouncing
to me if UACSC2.albany.edu was used as some kind of gateway, I can't
imagine how a LISTSERV listname could appear as the NODENAME.
( the size ranged from 122-129 based on RECEIVED chain )
( Just worried that someone has come up with trick to automatically
  reroute spamming bounces to non-sender )
 
- mike
 
( Unfortunately, all my copies have been deleted - but envelope info
  is removed before item goes into my reader - correct ? )
 
( I don't really want to spend any time on this, but feel uneasy .... )