In a context of controlling
spam sent to forged e-mail addresses, voluminous amounts of returned mail is directed to a forged domain's
catch-all e-mail account. Bounced mail is not really spam, per se, but rather collateral damage caused by a responsible
ISP who is informing an addressee (not knowing it's faked) that recipient's e-mail account is problematic due to capacity overflowing, addressee unknown, or other difficulties.
This is a first indication to an
innocent bystander that his or her legitimate domain name has been hijacked for fake spamming operations. This is a quandary for the domain's administrator on how to inform the dutiful ISP that the e-mail address domain has been faked and spam lobbed into domains under the ISP's control. When the bounced message flow volume is very high and egregious, sometimes the bounced messages are sent as spam reports so that the affected ISP can use other countermeasures to stop spammers by using reverse
IP address lookups and other techniques.
A common ISP warning message states something like "the message carried your return address, so it was either a genuine mail from you, or a sender address was faked and your e-mail address abused by a third party, in which case we apologize for undesired notification.
"We do try to minimize
backscatter for more prominent cases of
UBE [
UCE] and for infected mail, but, for less obvious cases of UBE, some balance between losing genuine mail and sending undesired backscatter is sought, and there can be some collateral damage on both sides."
