isHIDDEN@y.com mentioned in domuser.dat by any chance?

Failing that I'm a little surprized, I could take a look directly if you 
like.

     ChrisP.


On 26/05/2015 1:20 a.m., David Camm wrote:
> checking my email this morning i cam across the following (redacted):
>
> g_user_send_warning: HIDDEN@y.com) 500 >= 500, User send warning 
> reached (from ip 96.47.226.20), user has sent a lot in one day, 
> g_user_send_max=0
>
> the ip address is registered to a network in germany, so obviously 
> something amiss. the spammer used several different combinations of 
> user name/source ip addresses in the from envelope and i've seen that 
> before.
>
> what i DON'T understand is the account HIDDEN@y.com) is a redirect 
> (was='xxx' to=HIDDEN@q.com') anad, as such doesn't have a login.
>
> so, how could it be used to send????
>
> david camm
> advanced web systems
> keller, tx
>
>
>
>
>
>
>
>