Subject: Wrong return address

From: "Jackie \"Oh!\" Owen" <[email-masked]>
Date: Thu, 28 Oct 1993 12:58:12 -0400 (EDT)

Attached is a message one of our faculty received.  She (username: 
sscher) was trying to get some information from a listserv and 
incorrectly entered the To: address.  Needless to say, the message was 
returned to her, but if you look at the From: line of the unsent 
message, it says that this message was sent by pchang, not ssher.  I 
tried to replicate the problem with no luck.  There is a user pchang on 
this system, but he has never logged in.  No one else had this problem.  
The syslog entries for this and a few more similiar messages look normal.
The password entries for each look okay also.  We're running ULTRIX 4.3 
and Pine 3.87.

Any ideas, suggestions?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jackie Loucks Owen				Network Administrator
[email-masked]				Ramapo College of NJ
						Mahwah, NJ

        "Time flies like an arrow.  Fruit flies like a banana."
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---------- Forwarded message ----------
>From MAILER-DAEMON Mon Oct 25 17:36:11 1993
Date: Mon, 25 Oct 93 17:35:11 -0400
From: MAILER-DAEMON (Mail Delivery Subsystem)
Subject: Returned mail: Host unknown
To: sscher
Status: RO
X-Status: 

   ----- Transcript of session follows -----
550 acdvm1.uottawa.ca.tcp... 550 Host unknown
550 [email-masked]... Host unknown

   ----- Unsent message follows -----
Date: Mon, 25 Oct 1993 17:33:47 -0400 (EDT)
From: Pat Chang <[email-masked]>
Subject: social work discussion group
To: [email-masked]

get socwork directory

>From MAILER-DAEMON Mon Oct 25 17:39:24 1993
Date: Mon, 25 Oct 93 17:39:17 -0400
From: MAILER-DAEMON (Mail Delivery Subsystem)
Subject: Returned mail: Host unknown
To: sscher
Status: RO
X-Status: 

   ----- Transcript of session follows -----
550 acdvm1.vottawa.ca.tcp... 550 Host unknown
550 [email-masked]... Host unknown

   ----- Unsent message follows -----
Date: Mon, 25 Oct 1993 17:38:05 -0400 (EDT)
From: Pat Chang <[email-masked]>
Subject: 
To: [email-masked]

get socwork directry

>From MAILER-DAEMON Mon Oct 25 17:43:28 1993
Date: Mon, 25 Oct 93 17:43:26 -0400
From: MAILER-DAEMON (Mail Delivery Subsystem)
Subject: Returned mail: Host unknown
To: sscher
Status: RO
X-Status: 

   ----- Transcript of session follows -----
550 ab.umd.edu.tcp... 550 Host unknown
550 [email-masked]... Host unknown

   ----- Unsent message follows -----
Date: Mon, 25 Oct 1993 17:42:35 -0400 (EDT)
From: Pat Chang <[email-masked]>
Subject: 
To: [email-masked]

subscribe socwork

---

From: Mark Crispin <[email-masked]>
Date: Thu, 28 Oct 1993 11:32:12 -0700 (PDT)

Is there any possibility that pchang and ssher have the same user number?

---

From: "Jackie \"Oh!\" Owen" <[email-masked]>
Date: Thu, 28 Oct 1993 14:49:30 -0400 (EDT)

I checked that out first thing.  They both have very different user IDs.  
ssher's account was created last year and pchang's acct was created on 
October 22.

---

From: Joe Pollock <[email-masked]>
Date: Thu, 28 Oct 1993 13:08:00 -0700 (PDT)

We've seen exactly the same thing here, with Pine 3.07 and Ultrix 4.2 (A?).
In this case, the messages with the strange headers appeared in the user's
sent-mail folder, with the name of a user of an account I had created a
few hours earlier.  The user has no idea what she did, and the debug files
didn't look out of line.