So I found this document that discusses Aliasing, 

However, the odd thing is that the mail is showing "None" for the address on the second line. I can't say as I know what is happening there, but are you doing any aliasing that might be the culprit?

Let me know.
Thanks! 

Hi there,

What's your environment setup? Is the SBG Appliance at the gateway ? Are you using LDAP ?

Thank you,
Marco Bicca

 The Scanner appliance sits in the DMZ as the gateway and the Control Center sits in our lan. We are using LDAP. No issues with LDAP in our logs...

Hi There..

Did you checked in the audit logs for both same mail coming from same  source address ?

Did your brightmail is enable with IP Reputation service ?

awaiting for reply !!

You said you are using LDAP Right? Are you seeing recipients being rewritten in the Audit Log? Can you actually post a screenshot of exactly what you see in the Message Audit Log screen results?

so you can see with the pic above, the appliance thinks its getting 2 emails and behaves differently on the second one...Never saw this before we upgraded to ver 8.

Need help! :)
Stephen 

Hi,

I've seen a similar issue in the past and is documented in the following KB article:
service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2009101313280854
I remember there was an upstream device blocking the inbound SMTPO EHLO command forcing the remote MTA to fail back to HELO (apologies if this is too technical).
Hope it helps. Let me know.

Regards,

Federico