(visigoth@ANDREW) (strange.things) [19-Sep-1995, 14:56] (context)
 
 Here's the info from the message-id and filename for the first message.
 
 `MkKurli00iWPQ9Nmcy'': generated 17 Sep 1995 at 1:11:13 EDT from 
 PCS30.ANDREW.C
 MU.EDU ([128.2.232.155]), pid 2407, ctr (mod 256) of 42.
 `AkKwHly00UfB81Opkt'': generated 17 Sep 1995 at 2:49:21 EDT from 
 BB5.ANDREW.CMU
 .EDU ([128.2.10.205]), pid 363, ctr (mod 256) of 92.
 
 Unless he's very, very clever, there should be no way someone could fake the
 andrew authentication lines if it's from an andrew host.
 
 
  V (visigoth@ANDREW) (strange.things) [19-Sep-1995, 14:59] (context)
 
 Here's the second message:
 
 `EkL0ocW00iVDA182Y='': generated 17 Sep 1995 at 7:57:28 EDT from 
 PCS27.ANDREW.C
 MU.EDU ([128.2.232.79]), pid 288, ctr (mod 256) of 41.
 `IkL1WUm00UfB02z4UN'': generated 17 Sep 1995 at 8:46:24 EDT from 
 BB5.ANDREW.CMU
 .EDU ([128.2.10.205]), pid 764, ctr (mod 256) of 72.
 
 
  V (visigoth@ANDREW) (strange.things) [19-Sep-1995, 15:00] (context)
 
 And the last, which he claims is the only real one:
 
 `kkLUWja00UfBMLoRQE'': generated 18 Sep 1995 at 20:02:55 EDT from 
 BB5.ANDREW.CM
 U.EDU ([128.2.10.205]), pid 6097, ctr (mod 256) of 215.
 `4kLQW6O00WBMA6UGsb'': generated 18 Sep 1995 at 15:29:10 EDT from 
 PCS8.ANDREW.C
 MU.EDU ([128.2.35.88]), pid 1665, ctr (mod 256) of 46.
 
 Looks mighty similar, unless he's stupid enough to let other people use 
 his account.