On Tue, 13 Oct 21:21 PDT, Richard Childers <[log in to unmask]> wrote: >True, but examining the header, I see the following : >> Received: from gatekeeper.us.oracle.com by hqsun1.us.oracle.com >> (5.59.9/37.7) id AA02018; Mon, 12 Oct 92 09:43:08 PDT >> Received: from pucc.Princeton.EDU by gatekeeper.oracle.com (Oracle >> 1.12/37.7) id AA10595; Mon, 12 Oct 92 09:43:08 PDT >> Message-Id: <[log in to unmask]> >> Received: from PUCC.PRINCETON.EDU by pucc.Princeton.EDU (IBM VM SMTP V2R2) >> with BSMTP id 9628; Mon, 12 Oct 92 12:35:43 EDT >> Received: from PUCC.BITNET by PUCC.PRINCETON.EDU (Mailer R2.08 ptf043) >> with BSMTP id 6462; Mon, 12 Oct 92 12:32:28 EDT > This tells me that the message was delivered over BITNET to PUCC, implying that LISTSERV@PUCC received a "distribute-job" from [log in to unmask] Then LISTSERV@PUCC sent E-mail to MAILER@PUCC, and MAILER@PUCC sent E-mail to SMTP@PUCC, and SMTP@PUCC delivered it to [log in to unmask], and GateKeeper delivered it to HQsun1.US.Oracle.COM, where Richard read it. I'll bet that **every** piece of E-mail from LSTOWN-L to Richard has slight-variants on the above header-lines! Notice that these headers give absolutely **no** information on how the "forgery" reached the location [log in to unmask] So, if you did check the logs at Princeton, you could verify that LISTSERV@INDYCMS did send E-mail to LISTSERV@PUCC, but you'd be no closer to finding the ID of the "forger". You'd have to check the logs written by LISTSERV@INDYCMS, MAILER@INDYCMS, and [log in to unmask]