- all kinds of other garbage in random fields
- sender IPs that were faked etc
Anyone interested in looking at all the possible permutations of spam, can view the spamassassin rule sets which are quite comprehensive by now. Spamassassin has been around for close to 20 years.
Do you think this is still possible?
This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined.
What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.
RFC 6854 updated the From field to allow an empty group construct (see https://explained-from-first-principles.com/email/#no-reply) but mainly for other reasons (see https://explained-from-first-principles.com/email/#email-add...).
DMARC authentication either rejects multiple addresses in the From field or authenticates them all and applies the most strict policy (see https://explained-from-first-principles.com/email/#domain-ba...).
The phrase "be liberal in what you accept, and conservative in what you send" certainly applied to SMTP which led to all kinds of craziness in spam.
For example:
- Emails with multiple "From" fields in the headers
- Totally bogus relay chain data
- all kinds of other garbage in random fields
- sender IPs that were faked etc
This was also around the time that spammers were switching to using bas64 MIME encoded images to get around text filters.
The company I worked for actually got pretty good at analysing the spam thanks to a combination of a IMDB style web based browser for the spam I put together and good old fashioned "leg work" to track the owner of URLs, merchant accounts etc. That in turn led to some of the spammers actually shutting down.
More details here: https://twitter.com/alexpotato/status/1208948480867127296