We have distribution list expansion enabled in BrightMail 9.0.1 for the reason of individual spam release for the list members. However, we found that now everyone could send email to those distribution lists with message restrictions to certain users.
It looks like the distribution list is expanded and sent to individual users so that the downstream server (eg Exchange) do not realise the email was sent to the restricted list.
This also increase the volume of quarantined spam as previously spammers are rejected when sending to these lists.
How could it be corrected?