Probably because the spammers use a shotgun approach and there was someone with a similar address on another mail server somewhere, so they're just using a "dictionary" attack because they don't care if they only reach 2-3% of the people they're sending to, because about another 2-3% of THOSE will fall for the spam and the spammers will make money.
It's like shooting a nuclear weapon to kill a fly -- overkill, but it'll probably get the job done, and since it costs them next to nothing to send out a few thousand emails (the nuclear weapon) if 2-3% of their emails reach a real person (the fly) they've exceeded their expectations. If you're really interested in spammer behavior, I recommend the SpamCop forums (http://forum.spamcop.net) -- it requires registration to post, but you can rest assured they will NOT sell or share your information with anyone else... :-) They also have an NNTP server you can log into, but spammers have been known to troll there for email addresses, and since it's an open news server (although not linked with the rest of Usenet) anyone can load it up and get email addresses. John Aldrich -----Original Message----- From: Kim Schotanus [mailto:[EMAIL PROTECTED] Sent: Thursday, November 11, 2004 9:28 AM To: Exchange Discussions Subject: RE: junkmail problem But why go through the effort of having a fake address of ours in the TO-line? K/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Aldrich Sent: donderdag 11 november 2004 15:19 To: Exchange Discussions Subject: RE: junkmail problem Ever hear of the "BCC" field? That's probably what happened. Your user's email address is probably on one of the "Millions" CDs that spammers sell each other... and if she ever "unsubscribed" she's almost definitely on some spammer's list as a "confirmed" email address. About all you can do is change her email address and educate her on the proper handling of junk mail (i.e. delete it or report it.) John -----Original Message----- From: Kim Schotanus [mailto:[EMAIL PROTECTED] Sent: Thursday, November 11, 2004 9:15 AM To: Exchange Discussions Subject: junkmail problem Hi there, I have a user that receives all kinds of junk mail that is not even addressed to her. How can this happen? for example: Microsoft Mail Internet Headers Version 2.0 Received: from relay2.tiscali.nl ([195.241.76.120]) by morpheus.intas.be with Microsoft SMTPSVC(5.0.2195.6713); Thu, 11 Nov 2004 11:59:19 +0100 Received: from adsl-68-93-100-25.dsl.rcsntx.swbell.net (adsl-68-93-100-25.dsl.rcsntx.swbell.net [68.93.100.25]) by relay2.tiscali.nl (Postfix) with SMTP id BDF4A1C915; Thu, 11 Nov 2004 11:44:02 +0100 (MET) Received: from relay2.tiscali.nl by adsl-68-93-100-25.dsl.rcsntx.swbell.net with DAV; Thu, 11 Nov 2004 03:24:29 -0600 Received: from 43.9.165.2 by sbcmail4.prodigy.net with HTTP; Thu, 11 Nov 2004 03:23:20 -0600 Date: Thu, 11 Nov 2004 14:24:29 +0500 Content-Transfer-Encoding: 7bit From: "Kuhn" <[EMAIL PROTECTED]> MIME-Version: 1.0 Message-ID: <[EMAIL PROTECTED]> To: "Aster" <[EMAIL PROTECTED]> Content-Type: text/html; charset=ISO-8859-13 Subject: Re: and, suddenly swinging his Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 11 Nov 2004 10:59:19.0765 (UTC) FILETIME=[7E865850:01C4C7DD] I don't see any reference to the user ([EMAIL PROTECTED]). (the only thing I know is that she is alphabetically the first user in our AD, but that doesn't make much sense?) "Aster" <[EMAIL PROTECTED]> does not exist in our organisation and this message should actually be undeliverable, but how does it end up with Aoife? greetz, Kim _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
