OK... let me begin by saying this isn't a linux-related question of any sort. I'm asking because where I do my co-op, one of the other tech guys brought it up and I realized I have no idea how this happens, but have certainly noticed that it does happen (across desktop-clients and webmail).

How is it exactly that a user whose email address is, say johnblake@so-and-so.com, receive spam email addressed to brain@our-corporate-parent.com and other such non-existent addresses?

I've noticed the same thing with my own email accounts (mainly web-accounts) over the years but never really gave it any thought until now.

Any answers out there? Tried googling, but not really coming up with much of an answer except verification that the problem exists and lots of people experience it.

Email is sent by SMTP, the Simple Mail Transfer Protocol.

Basically, one computer (the client) opens a connection to another computer (the server), and transmits a message in two parts: The SMTP header, and the email message.

The SMTP header is actually negotiated between the client and the server, and contains the actual destination address of the email to which the message is to be sent. The email message also contains a header, which can include information like who the message was from, and who it is for.

The SMTP server also telds to add information about the SMTP header to the email header, but it won't usually overwrite the to: address. There's also no reason why the client can't lie about the email address they're sending from; you don't even need an email address to send an email (only to recieve one).

That's rather simplified but I hope that helps to explain it.

— Robert J. Lee