I'm not sure of the terminology used for this, but I had a login similar to this on my system.

someone@www.mydomain.com

I understand that it's used to do a shared login from another site where 'someone' is registered and that's ok. But the person had *my* domain after the @ sign, not another domain! The name before the @ sign wasn't anywhere in my user list.

Any idea what went on here? The logs aren't very helpful. I'm using Drupal 4.6.5 and have disabled the Drupal module for now. I think that's what controls this being available or not.