The cron that's referenced in the email you forwarded that seems to have created this:

cd /home/aras/acis && nice -n 12 /home/aras/acis/bin/make-repec-per.sh

runs every hour and emails "aras@repec.org".  I see those emails as sent in the mail logs on the nebka server and on the mail relay that sends through AWS SES.  It would seem that you should be getting a lot of emails.

I'm not sure what to do with this.  If this is the only one you've seen, maybe we wait and see if another one ever gets sent to you, and see if that provides more information?

On Thu, May 10, 2018 at 1:14 AM, Thomas Krichel <krichel@openlib.org> wrote:
  Dan Hayes writes
> is this the 2nd email you've received?  or are you receiving a lot of them?

  It's the first itme in recent memory that I see this.
   
> it looks like the cron output is trying to be send to root@repec.org, which
> in theory should save in the local mailbox of root on this machine.  but
> instead its trying to send it out, which is bouncing back to aras@repec.org.
> the aras user has a .forward in the home directory sending this email to
> Thomas?

  That or check /etc/aliases

--

  Cheers,

  Thomas Krichel                  http://openlib.org/home/krichel
                                              skype:thomaskrichel