How did a hotmail address wind up as something else?

[vbuser]

I was looking at my bounce log and the recipient was blank. My original email was stripped too. I searched the email addy in my admin and nothing. Then I tried "ctylliros" and a hotmail addy came up. In fact, hotmail received this message from the looks of this:

Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

  ctylliros@cyatnet.com.cy






Content-Type: message/delivery-status
Content-Transfer-Encoding: 7bit

Reporting-MTA: dns;BLU004-OMC4S23.hotmail.com
Received-From-MTA: dns;BAY004-MC3F22.hotmail.com
Arrival-Date: Fri, 23 Jan 2015 04:08:05 -0800

Final-Recipient: rfc822;ctylliros@cyatnet.com.cy
Action: failed
Status: 5.5.0
Diagnostic-Code: smtp;554 The mail could not be delivered to the recipient because the domain is not reachable. Please check the domain and try again (-1915321397:308:-2147467259)

 

[Mike]

They likely configured Hotmail (or some other server) to forward their emails on to that email address. Hotmail then bounced it and returned the notification to the original sender.

This is where VERP is useful; the original email address would be encoded in the bounce return address.

 

[vbuser]

I think the VERP part was omitted as well. My other bounces have this information I believe:

X-To-Validate: some-alphanumeric-code + recipient's-address

I can send you what I have. I did figure out the user and manually invalidate his account.

 

[Mike]

If you have VERP enabled in XF, you should be able to look at the exact address that bounce notification was sent to. It will have the original address encoded in it.

Otherwise, if they didn't include parts from the original email, you'll have to guess as you did.