I have a customer who has had her email address posted to literally thousands and thousands of newsletter subscription and contact us forms around the planet. Germany, France, England, Poland, China, USA, etc. They're coming in fast and furious since last night, like ten to twenty per minute.

Her address was [username-a]@[herdomain.com] and we had set up an [useralias-b]@[herdomain.com] a while back. She'd like to use the alias as her main address now, so I removed the alias account, went to the hard drive to remove the folder from there, and then tried to do an account Rename and am getting errors. It won't let me do it.

Could it be because her account is the only one, and thus is the primary account?

Could it be because there is an echo somewhere of the alias still in the database?

And, has anyone heard of this kind of an attack? Almost all the emails are a "thanks for subscribing, please confirm your address".

Thanks