I was one of the lucky ones who issued SERVE-off command after first early-morning message arrived. During day I received approx 42 notices from my listserv "Mail received from user who has been served out" as attempted postings to our non-confidential lists arrived. What confuses me is that I also got (as postmast, from our MAILER ? ) about 35 other items. When I first entered MAIL, they items showed as From: Subj: Size: actuary@<local listname> Court Ordered Liquidation - C 129 where <local listname> cycled thru about 15 of our local listnames with several multiple occurances. After opening/reading some of these items, the From/To info sometimes changed to indicate internet listnames. Did anyone do a detail dump of the envelope of any of these postings ? I mean, while I could see stuff bouncing to me if UACSC2.albany.edu was used as some kind of gateway, I can't imagine how a LISTSERV listname could appear as the NODENAME. ( the size ranged from 122-129 based on RECEIVED chain ) ( Just worried that someone has come up with trick to automatically reroute spamming bounces to non-sender ) - mike ( Unfortunately, all my copies have been deleted - but envelope info is removed before item goes into my reader - correct ? ) ( I don't really want to spend any time on this, but feel uneasy .... )