On Wed, 17 Nov 1993, John Arnfield <[log in to unmask]>  wrote:
> I run a list (CLIMLIST) for people working in climatology and related
> disciplines.  It is moderated and only the list owner (me) can send to the
> list.  CLIMLIST is run from LISTSERV@PSUVM (aka [log in to unmask]).
> I distribute to it by email from Ohio State (magnus.acs.ohio-state.edu).
>
> I was very surprised on Monday when an item was distributed to the
> list which I had not sent.  It was a copy of last week's Digest and the
> 'Original sender' warning identified the sender as a CLIMLIST
> subscriber in Manitoba who had elected to receive the list in Digest form.
 
> My questions (after this long-winded preamble) are as follows.
> (1)  Why might the mail have been sent back to CLIMLIST@PSUVM?
 
This "reposting" has happened to me, too, on a moderated list.
 
Some mail-agents support a 'bounce' command, which sends the E-mail to any
address.  For example, here's the headers of one such message,
which I sent from my account on SOL.UVIC.CA to my account on UVVM.UVIC.CA
(I've "anonymized" [sic] some of the fields):
 
! Return-Path: <@UVVM.UVIC.CA:[log in to unmask]>
! Return-Path: <[log in to unmask]>
! Received: from johnny.u.washington.edu by sol.UVic.CA
! Received: by johnny.u.washington.edu
! X-Sender: [log in to unmask]
! Date: Wed, 17 Nov 1993 19:37:36 -0800 (PST)
! From: USER NAME <[log in to unmask]>
! Subject: Re: YOUR QUESTION
! To: Melvin Klassen <[log in to unmask]>
! In-Reply-To: <[log in to unmask]>
! Message-Id: <[log in to unmask]>
! Sender: [log in to unmask]
 
Note that the 'From:' line is still the original.
 
If I had "bounced" the E-mail to 'LSTOWN-L@SEARN',
LISTSERV would have ignored the 'Sender:', 'X-Sender:', and 'To:' tags,
and would have posted the message to the LSTOWN-L list!
 
The message would have appeared to have been posted by 'USERNAME'!
 
> (2)  Even if this did happen, why did LISTSERV then distribute it
>      to the list given that CLIMLIST is moderated?
 
Because the 'From:' line is the original, LISTSERV has verified
that the ID in that line *is* one of the "editor" IDs for the list.
 
Also, since it was a week old, LISTSERV didn't recognize the text as
a "duplicate" posting (the cache of previous-postings isn't infinitely big),
so, LISTSERV didn't reject it for that reason.
 
> With respect to (2), I am frequently contacted by people wanting to send to
> the list who have had their postings rejected as 'unauthorized', so I know
> that, in general, the restriction on sending works.  I guess the mail must
> have looked as though it came from me to LISTSERV.
 
Exactly.