Mandy wrote: > I work for a Canadian provincial government, on a system with about > 50,000 mailboxes. I scanned our outbound mail logs over the past 6 > months with this data. There were 31 replies to "Your webmail is > expired!! !" type messages in that period. > > If we had had been blocking outbound mail based on this list, the two > compromised accounts we had to deal with (one of which made the list > in its turn) wouldn't have happened. > > I definitely see value here.
Can you determine how many of those were out-of-office messages? Then again, even at just two, if you can stop such compromises, it's worth it (and then some). I'd still rather block the offending message than intercept responses to it (as that means it has suckered users, which means it has wasted their time). I see APER as a possible aid in that pursuit, though as Jesse has mentioned, it is not fully reliable (as to be determined). Still, these little checks add up, so even if APER gives a message 0.1 points, that might be enough to mark it as spam or even block it at the door. As a secondary defense, blocking replies sounds like a grand idea.
