>Don't trust what VRFY  says. Oh, if it says the  user doesn't exist, then
>it very  probably doesn't, but if  it replies positively it  doesn't mean
>anything.
 
In taking this advice, I also normally do a VRFY XXXX (meaning some
non-existent userid).  If I get a positive ack, then I do NOT trust it.
 
/Pete