[Mailman-Users] non-subscriber managed to post to a subscriberonly list

[Steve Lindemann]

Mark Sapiro wrote:
> 
> Right. That's why you have to look at the raw archive mbox file (not
> the html archive or the periodic .txt or .txt.gz file). That's the
> only place that will have the original envelope sender in the "From "
> separator and the original Sender:.

Thanks! Got it!  They spoofed a legitimate list member on the 
Return-Path:, which also showed up on the first ("From ") message header 
line.  The From:, Reply-To: reflected the purported spammer and there 
was no Sender: in the raw mbox file.  The good news is that there was no 
Approved: or Approve: but we're changing passwords anyway.

I don't suppose there's anything we can do about this other than change 
that particular user's email address... is there?
--
Steve Lindemann                         __
Network Administrator                  //\\  ASCII Ribbon Campaign
Marmot Library Network, Inc.           \\//  against HTML/RTF email,
http://www.marmot.org                  //\\  vCards & M$ attachments
+1.970.242.3331 x116