At 10:14 03/14/2003 Friday, Valdis Kletnieks wrote: >On Fri, 14 Mar 2003 09:07:51 CST, Jane K Gehan <[log in to unmask]> said: >> Many of our lists - lists that are not open subscription, and are >> confidental - have the following address on their monitor report. >> This address is not on any of the subscription lists. And it doesn't >> look like it ever was if I look at the modification date of the .list >> file. Any idea on what might be happening here? > >I've seen it get confused when bounces arrive in bad formats or from >the addresses that the recipient address is forwarded to.... End Reply Could this not be a spoofed OWMER-listname@listhost as the RFC821 MAIL FROM field with a bounce with a spoofed RCPT TO that then showed up in DMR? e.g., KLEZ