First, there is another thread about this same topic here
- it was opened on April 3 and at least two other boards are having the same problem. At least one of them upgraded from phpBB 2.x as Don did; it would be interesting to know if the third did as well. (Maybe a pattern emerging???) I posted a question in that thread asking the OP if this is indeed the case for his board. Hopefully he'll respond and we can get some idea of whether this is an upgrade issue or a general one.
Basically, the whole situation is this:
1. The forums running phpBB 2.x got hacked.
2. Don (the man running the site) updated the phpBB software to 3.0.1.
3. After Don was done with the upgrade, he sent one private message to every registered user on the site.
4. Some users, such as myself, received one e-mail notification of this private message. Other users have received (and are continuing to receive) many e-mails. Some users report a pattern of how long between e-mails, others are simply getting POed because they do not understand how an automated e-mail program functions and think that Don is intentionally spamming them. There is a thread at this location
that has a bunch of guys used to fishing talking about getting multiple e-mails.
I've downloaded and looked through the code for phpBB 3.0.1. Not knowing PHP, it wasn't a pretty process, but it appears that the pm_notification() routine is only called from one place. I started tracing the function calls, but quickly got lost.
An interesting thing is that the original e-mail address that was set up in the configuration is webmaster - AT - MichiganOutdoorsman.com. Don changed this to admin, but people are still getting multiple e-mails notifying them of this PM that show up as coming from webmaster significantly after this change. Further, some of the addresses are hosted on the same machine as the forums and the headers confirm that the e-mail never left the machine hosting the board, so we know that it's not a delay in the message traversing the internet. Don has since completely deleted the webmaster account, though I personally do not believe that this will do anything to solve the problem. While I was typing this, another user replied and said that he just got one from michiga3 - AT - host39.hostmonster.com; hostmonster is the hosting company and this user is where headers indicate the notification e-mails are originating from. Still having a continual stream of notification e-mails going out over one PM sent to everybody.
I would like to be able to get into a shell account and poke around in the mysql console to see what I can see there, but the host does not allow shell access. I suggested that perhaps there is database corruption, somehow preventing the system from remembering that it sent notification of this PM already, but it appears that everything is done on the fly and that the fact that the user was e-mailed a notification isn't saved anywhere.
I don't mind providing technical assistance as I can, but quite honestly don't know how much help I can be - I didn't write phpBB, don't know PHP hardly at all, haven't had the bug appear on either of my user accounts on Don's board, and don't have shell access to the server. Anything that you think of that I can do to assist in isolating where the bug causing this problem is I'll try to do.