This morning, our entire company received a spam message sent to [email protected], where "ourdomain.on.ca" is our actual domain. There is a distinguished name that this could correspond to:

CN=Users,DC=ourdomain,DC=on,DC=ca

Looking at the attributes though, there is no mail, no proxyAddresses, no signs that there is a mailbox configured there.

I did some LDAP queries, searching for:

(proxyAddresses=smtp:[email protected])
([email protected])

But am not seeing any records. (I also search for known email addresses to ensure the tree was being searched properly.)

We are running Exchange 2003. Is there another place to look for group email addresses? Is it possible that the distinguished name is being automatically translated to an email address?