Is there a way to disable this so called "feature". It has to do with the email alias feature given to site X users in the user admin panel. The email alias feature intercepts email to actual POPs if they are named the same.

So if i know your bob at and i am on with a valid user acount i can intercept your email.

This is a definate issue if users can highjack other known users email.