Here is the "relevant" header ppart I retrieved from my damaged Netscape
mail foler

[...]
> Received: from BROWNVM.BROWN.EDU by BROWNVM.brown.edu (IBM VM SMTP V2R2)
>    with BSMTP id 1990; Sun, 16 Mar 97 18:33:37 EST
> Received: from BROWNVM.BROWN.EDU (NJE origin LISTSERV@BROWNVM) by
> BROWNVM.BROWN.EDU (LMail V1.2a/1.8a) with BSMTP id 2009; Sun, 16 Mar 1997 18:33:37
> -0500
> Received: from BROWNVM (NJE origin SMTP@BROWNVM) by BROWNVM.BROWN.EDU
> (LMail
>           V1.2a/1.8a) with BSMTP id 7072; Sun, 16 Mar 1997 18:33:30 -0500
> Received: from dfw-ix5.ix.netcom.com by BROWNVM.brown.edu (IBM VM SMTP V2R2)
>    with TCP; Sun, 16 Mar 97 18:33:26 EST
> Received: (from smap@localhost)
>           by dfw-ix5.ix.netcom.com (8.8.4/8.8.4)
>           id RAA11942; Sun, 16 Mar 1997 17:20:49 -0600 (CST)
> Received: from lin-ne3-07.ix.netcom.com(204.32.191.103) by
>           dfw-ix5.ix.netcom.com via smap (V1.3)
>         id sma009073; Sun Mar 16 17:19:18 1997
> X-Sender: [log in to unmask] (Unverified)
> Message-Id: <v01510100af522ca9bd53@[204.32.191.69]>
> Mime-Version: 1.0
> Content-Type: text/plain; charset="us-ascii"
> Date: Sun, 16 Mar 1997 17:15:42 -0600
> To: [log in to unmask], [log in to unmask],
[...]

So it would appear as someone logged on "dfw-ix5.ix.netcom.com"
on Sun, 16 Mar 1997 17:20:49 -0600 (CST) (I would even hazard
dfw is Dalla/Fort Worth they are in CST, I think) ...

And tried to make an e-mail look like it was from
[log in to unmask] (Bill)

the -request suffixes and LISTSERV hosts at the end could point to
someone
used to "listserv" majordomo-in(bad)--disguise
ditto for subject and "sub list e-mail syntax"
> >From: [log in to unmask] (Bill)
> >Subject: subscribe
> >
> >subscribe * [log in to unmask]
> >end
> >
But that's just a hunch ...

In any case may the scumbag SOB rot in Hell (even AO-Hell) or worse
may be condemned to own and maintain a "majordomo" list for life
plus five years ! Or even in the faintiest fantasy that tey catch
the person from system logs time crosschecking, what about we
have this person deliver LISTSERV notifications for all those
list barefoot carryying his own canoe ... and *without* paddles!

In a violent attack of reality check I will forward the relevant
part to postmasters/abuse relevent sites (AOL, DFW-IX5-IX.NETCOM.COM)
I also encourages any list owner that recevied the :
[log in to unmask] (Bill)
2 things can come out of that: They catch the person or
IX.NETCOM.COM will pay more attention to their system security
I've seen that domain involved in spamming and Internet
abuse before maybe it's time they do something about it  ...



--
Eric Paul-Hus , BLUES-L