I think this may have been a fluke, but I want to ask anyway. I had an incident where a user, Bob, received some spam messages that were addressed to another user, Barbara. When viewing the headers of the e-mail messages, it didn't appear that the messages were addressed to Bob or to any distribution list/alias related to him. Both users received the messages.
If it makes a difference, we have two domains, mpcsd.org and mpcsd.k12.ca.us. the .org domain was how Zimbra was set up and the .k12.ca.us domain was added later as an "alias" to .org. The spam messages were both sent to Barbara at the alias domain.
I did some test and they're properly receiving non-spam messages addressed to them.
One thing that crossed my mind was BCC. If somebody was spammed as a "BCC" recipient, would this not show in the headers?
Anywho...is it something I should worry about?