title: smtp, hidden 'rcpt to' value
body: <p>received an email from a spammer addressed to a non-existent user in my domain, let's call it example.com. obviously the headers had been spoofed but i must assume the 'rcpt to' field was legit for it to reach me. i have all messages forwarded to my gmail from my domain's sendmail.</p>
  
  <p>trouble is nothing in the message source in gmail is showing which of my the legit email addresses the spammer specified to reach me. all i see in the message source is the bogus email. i can't reproduce this either. this is the first 'received from' part:</p>
  
  <pre><code>&gt; Received: from SQSZJWGPY ([1.52.114.198]) 
  &gt; by example.com (8.14.4/8.14.4) with ESMTP id s5PEIUCI003583;
  &gt; Wed, 25 Jun 2014 10:18:31 -0400
  </code></pre>
  
  <p>in all other emails the last line looks something like this:</p>
  
  <pre><code>for me@example.com; Wed, 25 Jun 2014 10:32:11 -0400
  </code></pre>
  
  <p>so the legit email is revealed. i know the envelope is not included in the message source but there must be a way to find out what the 'rcpt to' value was without going into sendmail logging and what not. how did the spammer hide the email he specified?</p>