The x-rcpt-to points to the final delivery mailbox for this copy of the message...If the user listed there is not part of the header I would have to guess it was a BCC to that user as it most definitely was in the envelope
Eric S ----- Original Message ----- From: "Rick Baranowski" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Tuesday, November 30, 2004 11:01 AM Subject: [IMail Forum] Mail getting forwarded to another account I have been trying to figure this out but I have had no luck. We have a virtual domain that is getting email sent to different accounts and looks like it is getting forwarded (maybe) to the webmaster account on this domain, but only S P A M. The user are receiving there mail and some S P A M. The headers show that it is getting sent to the user but at the end of the headers it has X-RCPT-TO: [EMAIL PROTECTED] We are using both Declude and Ipswitch spam control but there are no rules set on both the receiving domain and the virtual domain that forwards spam(we do have rules on some of the other domains but not these two). We have also received S P A M that is sent to user account that does not exist anymore. The nobody account is set to blank and the postmaster is set to root and none of the email accounts are forwarded anywhere. Does anybody have any suggestions? Thanks Rick Received: from user197.c82-197-238.citynet.nu [82.197.238.197] by receivingdomain.net (SMTPD32-8.05) id AED66C1023E; Tue, 30 Nov 2004 07:08:22 -0700 X-Message-Info: IZbrjTNXZ81hhezfvxsi275 Received: from sinful-dns.yahoo.com (247.0.196.243) by gh17-oc34.yahoo.com with Microsoft SMTPSVC(5.0.2195.6824); Tue, 30 Nov 2004 09:03:11 -0500 Date: Tue, 30 Nov 2004 19:00:11 +0500 (CST) Message-Id: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: SPAM: Message subject From: Frederick Elkins <[EMAIL PROTECTED]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--5153329322587086714" X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: HELOBOGUS: Domain user197.c82-197-238.citynet.nu has no MX or A records [0301]. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 83, weight 6) X-RBL-Warning: WEIGHT10: Weight of 23 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [82.197.238.197] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, CMDSPACE, HELOBOGUS, ROUTING, GIBBERISH, WEIGHT10, WEIGHT20 [23] X-Note: This E-mail was sent from user197.c82-197-238.citynet.nu ([82.197.238.197]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 401772848 Received: from cable-62-205-87-34.upc.chello.be [62.205.87.34] by receivingdomain.net (SMTPD32-8.05) id A5B55FF01D8; Tue, 30 Nov 2004 07:37:41 -0700 X-Message-Info: 1M13568NMWVgg37643Z106sYHsztnB76918nsdmPRV5766jngbeFMVshcdDHCSD438749RBTD748 Received: from [EMAIL PROTECTED] ([60.176.103.37]) by [EMAIL PROTECTED] with Microsoft SMTPSVC(5.0.8886.9417); Tue, 30 Nov 2004 12:38:30 -0300 Message-ID: <[EMAIL PROTECTED]@kki.net.pl> X-Originating-IP: [32.41.156.225] X-Originating-Email: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] Reply-To: "Dudley Floyd" <[EMAIL PROTECTED]> From: "Dudley Floyd" <[EMAIL PROTECTED]> To: "Dick" <[EMAIL PROTECTED]> Subject: take this job and shove it Date: Tue, 30 Nov 2004 16:36:30 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--433758564418846" X-IMAIL-SPAM-VALFROM: (100598232) X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT10: Weight of 10 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [62.205.87.34] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: CMDSPACE, ROUTING, WEIGHT10 [10] X-Note: This E-mail was sent from cable-62-205-87-34.upc.chello.be ([62.205.87.34]). X-IMAIL-SPAM-STATISTICS: 1.0000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 401772849 To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
