Susan "I like my SPAM fried with a little mustard on top" Young
In this particular case, there isn't a lot I can do before hand. Sandy's machine has been compromised and the agent is sending out this message to every email address it can find on her box. I've removed her from the accept/distribution. Because it is coming from a valid person, it will flow on through. I remove them from the archives and remove the compromised email address from the list.
But the other side effect of this compromise is that all of these harvested email addresses, along with the "signature" of the email are sent back to the the originator of the compromising agent. These harvested addresses are then used to send directly to people (bypassing our server). Generally, these secondary emails are not passed through the list b/c the sending agent is not acceptable. But they will go directly to people with what appears (via the [RC] ... in the subject and possibly the footer) to come from ridecamp. You can always to to the archives and see the difference. It the one you received is not in the archives, it didn't come to you via the list.
It is an ongoing battle. Right now, if you try to discuss "p a ypall" (w/o the blanks), your message is not going to go through the ridecamp list server. Draconian, but I couldn't find any distinct patterns to filter on.....
I did notice that facebook just one $700M+ in compensation from a spammer. Guess that would be a way to finance ridecamp:)
