That "Email from Wikimedia's Bugzilla" is not sent by us, see headers:

Received: from fiji.lbl.gov (fiji.lbl.gov. [128.3.61.98])

Obviously folks over there copied old stuff from Wikimedia:

• http://fiji.lbl.gov/mediawiki/
• http://fiji.lbl.gov/mediawiki/wmfmailadmin/

Whatever triggers those emails at lbl.gov, it's an old staging ground.

There is nothing we can fix on our side. hexmode wanted to email them.

I am now CC'ing random folks with a @lbl.gov address on this ticket, as this is distracting and misleading ("identity theft" is a too strong term though).

Don't we have SPF turned on?

Received-SPF: none (google.com: mhershberger@wikipedia.org does not
designate permitted sender hosts) client-ip=128.3.61.98;
Authentication-Results: mx.google.com;

spf=neutral (google.com: mhershberger@wikipedia.org does not

designate permitted sender hosts)
smtp.mail=mhershberger@wikipedia.org;

dmarc=fail (p=NONE dis=NONE) header.from=wikimedia.org

interesting.... did not look at the headers.

I see that i got these emails in the past years, never replied and still am cc ;)

• Bug 67277 has been marked as a duplicate of this bug. ***

Hm.. indeed. My reply bounced because mhershberger@wikimedia.org no longer exists – as Mark works independently now.

mej wrote:

I have contacted the scientists responsible for that server as well as our Cybersecurity team. I will update you all via this bug as I hear back from them.

Michael: Thank you so much for your help!

mej wrote:

Not a problem, Andre. Glad to help.

fiji.lbl.gov has been taken off the Internet by our security group until the misconfiguration is fixed and the code updated. For purposes of this ticket I think the issue can be considered resolved. :-)

Awesome. That was fast. Thank you!

Closing ticket as FIXED; anybody please reopen if you still receive such mail.