How an Outlook 2003 email sent without user's notice

[Guest]

A mystery happened when 3rd party received an email from one of my users, but
she was unaware of sending email. I checked the "Send Items" folder and
"Deleted Items" folder, nothing found. I checked the internet header I got
from the 3rd party recipient, no "To:" shown in the header and "BCc" is empty.

My questions
1. Is it possible that Outlook could send out email with "To;", "Cc", "BCc"
specified?
2. How is it possible there is no message in "Sent Items" and "Delete Items"
folder? (Send a copy of message to sent item was configured and delete items
folder was not cleaned up)

Thanks!!!

 

[Sue Mosher [MVP-Outlook]]

How do you know the sending address wasn't just spoofed, as the bulk of spam is?

1) A Bcc address would not be visible to the recipient, only to the sender.

2) I can think of at least three different ways, starting with Shift+Delete.

 

[Brian Smither]

Of the various bugs present in Outlook 2000, we have been suffering from
one very dangerous situation - and it's rare that it happens. It sounds
like the same thing you had happen.

The best scenario we have that will probably produce it is to have an
illegally formatted address or perhaps just an extra illegal character
(say, a slash) in a group of addresses (more than one - in this case 5
and the illegal address was the word unknown without quotes) in the To:
field. If you try to send it, it should stay in the Outbox.

Now, compose and send another e-mail with more than one address in the
To: field. If the second message is being blocked by the unsent first e-
mail, then the experiment can proceed. If it did get sent, skip the next
paragraph.

Open the first e-mail as it sits in the Outbox. Fix the bad e-mail
address (either repair the bad address or remove the extraneous
character). Send it. The second e-mail should now be released as well.

If you have't fixed the first e-mail, do so now and send it. Now start
contacting the recipients of the first e-mail to see if they
inadvertently received copies of the second e-mail. Or maybe it's the
other way around. Either case, it's a dangerous situation. That is what
is happening to us.

Somehow, addresses from one e-mail are being given to another e-mail on
its way out.

Shortly, we will begin conducting some exhaustive experiments with
Outlook 2000's diagnostic logging feature switched on. That may give
clues as to who, in the list of e-mail addresses of the first message,
received the second.

(Just to answer any other comments, we are running Norton Anti-virus 2003
with outbound e-mail scanning active. There are NO viruses, trojans,
worms, spyware or anything of the sort present. Outlook 2000 is at SP1a,
not conected to Exchange server (internet mail only). Others have
reported this problem on the various Usenet newsgroups over the past
several years. We have not tried this with Outlook 2003. Running Windows
2000 SP4.)

As soon as I find an application with a comparable feature set as
Outlook, we will switch after it's performance can be tested.


1. Is it possible that Outlook could send out email with [that address
not in the fields] "To;", "Cc", "BCc" specified?

Once it sits in the outbox, the delivery according to smtp protocols
begin. Handshaking occurs between the smtp client (Outlook) and the smtp
server (your ISP). Then, eventually, RCPT commands are sent with one e-
mail address per RCPT command. Then the data, or body of the e-mail. A
bug in the system could add more RCPT commands than there are addresses
in the TO:, CC:, and BCC: combined. You won't know what happened. If the
bug is in Outlook, then having enabled Diagnostic Logging may reveal the
action but not the cause.

2. How is it possible there is no message in "Sent Items" and "Delete
Items" folder? (Send a copy of message to sent item was configured and
delete items folder was not cleaned up)

If the message was there but the addressee's address was not, then see
above. But if the e-mail address truely was not there, then maybe the
From address was forged. Check the Internet headerds again and find the
first Received By: line. If your client's machine isn't in that line, it
didn't come from your client's machine.

 

[Diane Poremsky [MVP]]

Which build of Outlook 2000 do you have and are you using Corp or Internet
mode?

If you try to send it, it should stay in the Outbox.

Outlook should try to resolve the address and bring up the address picker
dialog if the address is malformed. Can you post an exact example of the
malformed address so we can attempt to repro?



--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Join OneNote Tips mailing list: http://www.onenote-tips.net/

Of the various bugs present in Outlook 2000, we have been suffering from
one very dangerous situation - and it's rare that it happens. It sounds
like the same thing you had happen.

The best scenario we have that will probably produce it is to have an
illegally formatted address or perhaps just an extra illegal character
(say, a slash) in a group of addresses (more than one - in this case 5
and the illegal address was the word unknown without quotes) in the To:
field. If you try to send it, it should stay in the Outbox.

Now, compose and send another e-mail with more than one address in the
To: field. If the second message is being blocked by the unsent first e-
mail, then the experiment can proceed. If it did get sent, skip the next
paragraph.

Open the first e-mail as it sits in the Outbox. Fix the bad e-mail
address (either repair the bad address or remove the extraneous
character). Send it. The second e-mail should now be released as well.

If you have't fixed the first e-mail, do so now and send it. Now start
contacting the recipients of the first e-mail to see if they
inadvertently received copies of the second e-mail. Or maybe it's the
other way around. Either case, it's a dangerous situation. That is what
is happening to us.

Somehow, addresses from one e-mail are being given to another e-mail on
its way out.

Shortly, we will begin conducting some exhaustive experiments with
Outlook 2000's diagnostic logging feature switched on. That may give
clues as to who, in the list of e-mail addresses of the first message,
received the second.

(Just to answer any other comments, we are running Norton Anti-virus 2003
with outbound e-mail scanning active. There are NO viruses, trojans,
worms, spyware or anything of the sort present. Outlook 2000 is at SP1a,
not conected to Exchange server (internet mail only). Others have
reported this problem on the various Usenet newsgroups over the past
several years. We have not tried this with Outlook 2003. Running Windows
2000 SP4.)

As soon as I find an application with a comparable feature set as
Outlook, we will switch after it's performance can be tested.


1. Is it possible that Outlook could send out email with [that address
not in the fields] "To;", "Cc", "BCc" specified?

Once it sits in the outbox, the delivery according to smtp protocols
begin. Handshaking occurs between the smtp client (Outlook) and the smtp
server (your ISP). Then, eventually, RCPT commands are sent with one e-
mail address per RCPT command. Then the data, or body of the e-mail. A
bug in the system could add more RCPT commands than there are addresses
in the TO:, CC:, and BCC: combined. You won't know what happened. If the
bug is in Outlook, then having enabled Diagnostic Logging may reveal the
action but not the cause.

2. How is it possible there is no message in "Sent Items" and "Delete
Items" folder? (Send a copy of message to sent item was configured and
delete items folder was not cleaned up)

If the message was there but the addressee's address was not, then see
above. But if the e-mail address truely was not there, then maybe the
From address was forged. Check the Internet headerds again and find the
first Received By: line. If your client's machine isn't in that line, it
didn't come from your client's machine.

A mystery happened when 3rd party received an email from one of my
users, but she was unaware of sending email.

--
Remove INVALID from e-mail address.

Brian Smither
Smither Consulting

 

[Brian Smither]

Which build of Outlook 2000 do you have and are you using Corp or
Internet mode?

Of the installation having problems, we are using Outlook 2000 SP3
(9.0.0.6627) Internet Mail Only - Security Update. I've experimented with
an installation on another workstation: Outlook 2000 (9.0.0.2711).

Outlook should try to resolve the address and bring up the address
picker dialog if the address is malformed. Can you post an exact
example of the malformed address so we can attempt to repro?

I was able to reproduce this experiment today:

In a new (plain text, but I think it doesn't matter) message, start
entering e-mail addresses in the To: field. It doesn't matter what they
are. I used:

(e-mail address removed); (e-mail address removed); (e-mail address removed);

Now, intentionally create an illegal address:

test03invalid.net[;

followed by more addresses:

(e-mail address removed); (e-mail address removed); (e-mail address removed)

Click in the CC: field (that is, click out of the To: field).

Addresses up to but not including the malformed address will get
underlined. Click in the To: field and remove the "[". Click out of the
To: field.

The other addresses will then get underlined. Click back into the To:
field. Put the "[" back where it was. Click out of the To: field.

Here's what happens to me: the string

(e-mail address removed)[; (e-mail address removed);

changes to

(e-mail address removed); [;;; (e-mail address removed); weirdness - three copies;
(e-mail address removed); weirdness - three copies; (e-mail address removed)

where weirdness is the alias (or display name - whatever Outlook uses
from the Contacts) of a Contact that cannot be found. I used Find and
Advanced Find (but I don't have much experience with using Advanced Find)
with no results.

I did not try to reproduce our first mishap. But it involves a
distribution list where one of the entries has a Friendly Name matched
with an e-mail address of 'unknown'.

Now, it seems to me that this kind of problem, if more widespread than
just us, would have some kind of mention in Microsoft's knowledgebase.
Any clues?