I suspect you may be right as I know full well that a proper exchange admin can do bulk permissions changes. Here is the tracert (or sort of) on the domain. It looks like messagelabs are the providing service and they are leasing? http://www.robtex.com/dns/hostedservice2.net.html Thanks for the advice. It makes sense.