Yeah, I get those regularly – they are sent from a hotmail account in response to any postings to (for example) pen-test@securityfocus.com.

despite the fact they are reliably traceable back as far as bay0-omc3-s32.bay0.hotmail.com, hotmail’s security team continue to assert:

“we have thoroughly investigate the account and we have verified that the sender forged a Hotmail address to suggest that the message is associated with Hotmail.”

the other one I usually get is from “jhitsiri@proen.co.th” saying that the recipient has left the company. No response from postmaster@ or administrator@ that domain though, nor have they unsubscribed him from the list.