On Mon, 2 Feb 2004 09:54:22 -0800, "Ahern, Shannon" <[log in to unmask]>
wrote:

>I am getting Daily Error Monitoring Reports that contain references to
>accounts the do not even exist on the list.

First, you must understand that this is a normal, even common occurrence, and
not a cause for alarm.  I'll borrow the words of an esteemed colleague since
it is the most succinct explanation I have seen:

"This is probably due to a spammer or a spoofer (possibly a viral message
with a spoofed From:) having been sent either directly to the list's
owner-listname address, the listname-request address, or to the list
itself.  In the first case, the entry happens because any mail sent to
owner-listname is assumed to be a bounce.  In the second case, the entry
happens because the auto-response associated with the listname-request
address has bounced.

In the third case I should imagine that the message would fail to be posted
due to the sender not being subscribed (I assume that the list is Send=
Private, or at least not Send= Public) and the notification that the
posting failed then bounced back as an error.

In all three cases the address would show up on the daily monitoring
report, even though the address was never subscribed to the list.

The same sort of thing happens when a subscribed address is actually a
forward to a second address, and the second address starts
bouncing.  Occasionally (dependent on how the forwarding is set up) this
causes an entry in the monitor for the second address rather than for the
subscribed address, and you have to scratch your head for a while to figure
out who the actual subscriber is :)  Some forwarders do this correctly and
bounce the mail with the original To: line in tact.  Some forwarders are
broken and bounce the mail with the forwarding address instead.  So it's
entirely possible that the bouncing address is a forwarding address for one
of your subscribers -- although my guess is that you're really dealing with
spam here.

I see the same sort of thing every day on my lists, mostly due to spammers
sending mail to the -request address."