http://technet.microsoft.com/en-us/library/30b6a9e1-679f-4679-ae68-3d...
should help you out there.
Basically, an smtp conversation happens like this:
First, assuming your server is configured to Use DNS rather than Forward to
Host, it figures out, for each recipient, what server(s) it needs to talk to
to deliver the message.
Lets say you have a message going to 10 users, 5 of which are @domain.blah.
Exchange will start a conversation with the server responsible for
domain.blah and have, basically, the following conversation (Your server
will be noted as YOU: and the response will be RESP
YOU: EHLO (mydomain name)
RESP: 250 Welcome
RESP: (other stuff)
YOU: MAIL FROM:<
[email protected]>
RESP: 250 OK
YOU: RCPT TO:<
[email protected]>
RESP: 250 OK
YOU: RCPT TO:<
[email protected]>
RESP: 250 OK
And it will repeat that RCPT TO command once for each recipient at that
other domain.
So, you say that (e-mail address removed) is getting 3 copies of the message. Your
first test is to see if you're sending the same address three times.
Basically, what you really need to do is determine if the problem is
reproducible. Which means finding a customer of yours who has seen the
problem (and complained about it) and is willing to help you *fix* it.
At this point, there is almost no way to have any idea what happened before.
And, frankly, if the issue isn't reproducible (in other words, next time you
send to the DL, include a note asking any recipient who receives more than
one message to contact you. If they do, and all the logging is in place,
you might be able to figure things out) then there's every possible chance
that what happened before is nothing you can fix.
On the other hand, if message tracking is enabled, there might be something
in there. But, I'll be honest, I don't remember how to read those tracking
logs well enough to know if it would show you that user X was sent three
copies of the message. You may actually want to hit one of the Exchange
newsgroups as well.