I received a notification that a bug was closed. The email that closed the bug was a spam email sent to the address (bug-number)-done@bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737921 Maybe time to start requiring PGP signatures on control emails to the BTS?