Same message ID, 2 different senders

snorket

New Email
Hi,

Someone in my company got an email from a bogus email address (scan@mycompany.com) that spoofs our company's domain. I'm using Exchange, so I check the message tracker for scan@mycompany.com and I get the message ID - 123456@WHITMANTANIA.

I then check the smart host logs for the message ID. I get a hit but the sender address is completely different. Its AmyTen@telia.com, and not scan@mycompany.com.

I run message tracker again, but search for AmyTen@telia.com. The result is a mail with the same messageID. Can anybody explain this?
 
Top