On 12/22/2009 11:05, Andrew Bosch wrote:
>>>> Paul Russell <[log in to unmask]> 12/22/2009 10:01 AM >>>
> On 12/22/2009 10:45, Andrew Bosch wrote:
>> That is a tricky one. The spam sender could be any one of the editors or subscribers, assuming
>> that the spams he gets are not just coincidental. If he has access to the MTA logs, the SMTP
>> transaction information could be revealing.
>>
>
> Almost everything useful that he could find in the MTA log should also be
> present in the full message headers on the spam.
>
> Unless the envelope addresses are different from the To and From addresses.

The envelope-sender address should appear in the return-path header; the
envelope-recipient address is probably not relevant.

--
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame