If you have the Internet headers already, you can check without going through the logfiles and obtain an answer with a fairly high degree of certainty. If a user receives an email message and is not listed in the To: or CC: headers (either specifically or via a distribution list), then they were BCC'ed. (There are some other conditions that can cause it to occur: an Outlook forwarding rule from someone who is on the To: or CC: header, alternate recipients specified, some other pathological situations, but that is most of them. Going through the logfile could eliminate these as possibilities.) ________________________________ From: Francine Sibio [mailto:fsibio@xxxxxxxxx] Sent: Thursday, May 27, 2004 10:12 AM To: [ExchangeList] Subject: [exchangelist] RE: Email being replicated to users not in "to" field http://www.MSExchange.org/ You very well may be correct, I had not thought of that ... I assume if I go through the log files, I should see this? Thank you for your help "Michael B. Smith" <michael@xxxxxxxxxx> wrote: http://www.MSExchange.org/ They were very like BCC'ed (blind copy). -----Original Message----- From: fsibio@xxxxxxxxx [mailto:fsibio@xxxxxxxxx] Sent: Thursday, May 27, 2004 10:34 AM To: [ExchangeList] Subject: [exchangelist] Email being replicated to users not in "to" field http://www.MSExchange.org/ I am a newbie as an exchange administrator with an odd problem. Running Exchange 2000, with Symantec for virus protection. I have 2 users that are receiving email addressed to another user in the firm. Their name is not part of the "to" field in Outlook, yet they receive the email. The email is spam. Where or how do I begin to figure this out? Or, can someone refer me to an article that would help. I have made a copy of the internet headers via Outlook/options for IP lookup. Thank you for your help Francine CCA ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: michael@xxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: fsibio@xxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger <http://messenger.yahoo.com/> ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: michael@xxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')