My my my … it looks like sendmail [1] might be the culprit here, not Exchange. [2] As per RFC-821: [3]
>
```
"User name" is a fuzzy term and used purposely. If a host
implements the VRFY or EXPN commands then at least local mailboxes
must be recognized as "user names". If a host chooses to
recognize other strings as "user names" that is allowed.
In some hosts the distinction between a mailing list and an alias
for a single mailbox is a bit fuzzy, since a common data structure
may hold both types of entries, and it is possible to have mailing
lists of one mailbox. If a request is made to verify a mailing
list a positive response can be given if on receipt of a message
so addressed it will be delivered to everyone on the list,
otherwise an error should be reported (e.g., "550 That is a
mailing list, not a user"). If a request is made to expand a user
name a positive response can be formed by returning a list
containing one name, or an error can be reported (e.g., "550 That
is a user name, not a mailing list").
```
RFC-821, § 3.3. VERIFYING AND EXPANDING
>
```
EXPAND (EXPN)
This command asks the receiver to confirm that the argument
identifies a mailing list, and if so, to return the
membership of that list. The full name of the users (if
known) and the fully specified mailboxes are returned in a
multiline reply.
This command has no effect on any of the reverse-path
buffer, the forward-path buffer, or the mail data buffer.
```
RFC-821, § 4.1.1. COMMAND SEMANTICS
From my reading, it seems that sendmail should not be sending back the program name, but rather, it should just return the email address passed in.
This is not good …