GW all around on SUSE something (10.1 I think).

A user sent an email "To:" 2 dist. groups and 2 individual users, and "BC:"
to another dist. group (ALL internal users/groups).

After an unexpected internal user replied to this email, I was called to
"figure out what happened".

Well I'm stumped. Never seen anything like this in GW. The Sent Item for
this email clearly shows the 5 items listed above (3 dist. groups, 2 users)
as described. The advanced properties shows all the individual users (after
the dist. groups were expanded) and that list includes the incorrect user.
Now this user has NEVER been in any of the distribution groups (completely
wrong department). Since this user is actually in the list of the Sent
Item, it's not like it was forwarded/delegated from some other account (like
their boss).

I checked every address book of the original user, and there are NO
duplicate dist. group names, and the dist. groups are NOT listed in the
freq. contacts list. Everything appears to have "pulled" directly from the
"Novell GroupWise Address Book".

2 mitigating factors that I have not yet checked/verified:

A) This user is running in caching mode.
2) I have not looked directly on their machine yet (in case the caching
mode address book is different from the online address book). Hard to
believe there's a problem here since the incorrect user has never been in
any of the dist. groups but . . .

So -- any help on what to look at -- where to look -- what to look for? I
hate to give my users any excuse to distrust GW and its confidentiality.