So our company obviously receives spam just like every other domain out there.  We block a good portion of it too of course.  However, I've got a question that's been bugging me for quite sometime.

Now and again, I'll see a blocked message that has multiple recipients, all of which are users in our company.  The From: will be some random no name person, but the To: and CC: is full of usernames/email addresses of users that are actually setup in our domain.  Question is, how do these messages get populated with so many of our companies addresses? I Just don't think that the sender/virus/program of the original spam message would populate the email with all these addresses, some of the address are for users that left our company 7 years ago!

I'm just concerned that it may actually be something wrong with our Exchange 2010 box.  But it's locked down.  Are these spam messages able to do some type of query when they come in and populate the to: and cc: as a result of some type of search?

Anyone who knows what I'm talking about here and might have some good info for me, I'd appreciate it!!