Pegasus Mail & Mercury

I noticed a rather serious problem today:   My system's set up to block illegitimate mail.  I demand authentication to relay and I greywall, but today a piece of spam came through with one legitimate address for a local user, and about 12 users on other systems in the CC/BCC fields.  Because one user was legit the message was accepted by ...