Hacker sent a threat email to a address that not in ($users) view, but lots of users recieved it

HCL Notes/Domino 8.5 Forum (includes Notes Traveler)

Subject: Hacker sent a threat email to a address that not in ($users) view, but lots of users recieved it

Feedback Type: Problem

Product Area: Domino Server

Technical Area: Security

Platform: Windows

Release: 8.5.3

Reproducible: Unknown

The address is 0xljd7dcb2bfb4f3c2a5z@ourcompany.com

We don't have a person or group names 0xljd7dcb2bfb4f3c2a5z .

Also can't searched in $USERS view.

But hundreds of users received that email. It looks this name linked to a hidden group.

How can we do ?

SMTP TEST:
<< 220 mail.ourcompany.com ESMTP Service (Lotus Domino Release 8.5.3FP6) ready at Mon, 26 Nov 2018 10:01:18 폍
>> EHLO [xxx.xxx.xxx.xxx]
<< 250-mail.ourcompany.com Hello [xxx.xxx.xxx.xxx] ([xxx.xxx.xxx.xxx]), pleased to meet you
<< 250-HELP
<< 250-AUTH LOGIN
<< 250-DSN
<< 250-SIZE 59392000
<< 250 PIPELINING
>> MAIL FROM:<user@ourcompany.com>
>> RCPT TO:<0xljd7dcb2bfb4f3c2a5z@ourcompany.com>
<< 250 me@ourcompany.com... Sender OK
<< 250 0xljd7dcb2bfb4f3c2a5z@ourcompany... Recipient OK

Feedback number WEBBB6V6CC created by ~Yoshi Opfanathernivu on 11/26/2018

Status: Open
Comments: