This would have had to been one of the best cases of people clearly not well managed. They clearly have not been taught to use email effectively, sure everyone is basically blaming it in the technical event but what we have here is two failures of management.
Mail Server upgrade
The people managing this server clearly don?t know what they are doing, no that is not the techo’s that is their managers. Why did they authorize this without a suitable test plan, and who let them use a mail server as a list manager. I know Notes is a great system and capable of lots of good stuff but a long time ago some very smart guys wrote mailing list managers that sent messages out to large groups of people very efficiently and kept everyones details nice and safe. Management has failed here not the technology or the people that work on the systems
Use of email
It is clear that a lot of people on that mailing list that purport to operate in the realm of IT security are not very good at it, replying to an email that clearly wasn’t sent right and then continuing it so it become a big game. I think some peoples ego’s may have got ahead of themselves showing that in the end they might not be as smart as they would like us to think they are. Where was there managers when the problem started, why did one of them not act to shut it down quicker and why where there people inclined to keep sending back emails to keep creating the problem.
Hopefully they are going to learn, but expect to see another issue like it again in the press, lets face it until it is perceived as a risk to the business it wont get funding.
See ya round