[rt-users] Who is "Doctor Helga" ?

[Thomas Sibley]

On 08/23/2012 08:57 AM, Rob Lister wrote:
> On Thu, Aug 23, 2012 at 10:43:27AM -0400, Kevin Falcone wrote:
>> On Thu, Aug 23, 2012 at 03:03:11PM +0100, Rob Lister wrote:
>>>
>>> RT's output (slightly anonymized)
>>>
>>> Subject: Re: [TICKET #1234] Test
>>> From: Doctor Helga via RT <support at lonap.net>
>>> ------^^^^^^^^^^^^
>>
>> Is that what RT shows in the outgoing email or what the mail client
>> sees?
> 
> It's what RT puts in there. And you're right, it's getting it 
> from the "user" name.
> 
> My guess is that somebody spammed us with a "From:" header of:
> 
> From: Doctor Helga <support at lonap.net>
> To: support at lonap.net
> 
> And it auto-created that user.

You can look in the database or use the Perl API to see deleted tickets
created by that user and verify this.  You can also see who the user was
created by in the database (RT_System vs. someone else).

I'd argue that there are two bugs here:

1) That users can get created with an email address (or updated to an
email address) for which RT::EmailParser->IsRTAddress returns true.

2) That addresses for which IsRTAddress returns true are not filtered
out at the time the sender/creator is determined.