If the list has an archive, the list logs, the listowner can easily
check to see whether the item was actually distributed to the list or
not.  A spam/virus item, spoofing list distribution, will not be there.

I have cautioned my subscribers, more than once, about viruses/spam
spoofing list distributed mail.  I've told them what to look for, how they
can tell which is what.  Most often a problem with very clever viruses, but
sometimes spammers do it.  There were some in South America who did it
often, but haven't seen any from them for a good many months now so I
suppose someone did something about them, though I don't know.

Some of these can be so close to being absolutely correct in the header
that even someone who knows how to read the header might mistake it as
legit with a quick glance.  Only on close examination, really looking for
the flaws, are the flaws seen.  Check the logs (the list archive log should
be adequate).

Of course, sometimes they are are obvious, but still good enough to fool
subscribers, who really do not pay that much attention to the headers of
their eamil.  Well, neither do I, unless I think there is a reason to.

Douglas Winship  [log in to unmask]