Is outsourced email fundamentally insecure?

How secure can you make a hosted service? I was reading about the recent Hotmail/Google username blunder and the thought struck me that the security model might be fundamentally flawed. After all, if they force the use of an email address as a login identity then you have automatically given away your login identity to everyone whom you have sent an email, and by extrapolation a hacker could figure out the login for most other employees in your company eg

'Let's see now... if "John Smith" becomes "jsmith@xyz.com" then his boss "Rita Rose" should be "rrose@xyz.com".'

The same article pointed out that around 40% of people had the same password for every website they used and when you consider that most people on that list had a very simple password then it shouldn't take too long for a dedicated hacker to get external web access to a couple of email accounts in your corporate system.

Am I missing something here or is this a time bomb waiting to explode in Google's face?
.

In the “Had to Happen” Department

My google scans picked up a website offering a ‘crack’ for Foundations to let you enter a serial number and get the software working without needing to contact IBM/Lotus. I won’t bother listing the site because the serial number they provide is useless. Even if the serial number they provide was once accurate it will only last until your server phones home to Canada to check for any upgrades. Of course you could disable internet access for your server but then you can’t send or receive external emails. Kind of like stealing an expensive sports car but being unable to drive it on public streets because you know you’ll be caught.

If you want to try out Foundations then go to link where you can download a free evaluation copy of Foundations.
.

Weird IP address on Bad-Guy probe into Foundations server

I noticed this morning that a customer's Foundations server is being probed by the bad guys and Foundations is duly reporting the event in the log.

02:01:33 PM Authentication Server Error Authentication failed for Administrator@210.154. 16.12 (ftp)
02:01:41 PM Authentication Connection Warning Command 'auth' failed (user='Administrator').
02:01:44 PM Authentication Server Error Authentication failed for Administrator@210.154. 16.12 (ftp)
02:01:52 PM Authentication Connection Warning Command 'auth' failed (user='Administrator').

DNSStuff.com told me the address was owned by TOCKA-COM which is a Russian language website with some (ahem) interesting pictures on its front page.

Nothing newsworthy in that. I'm sure that everyones server gets pinged on a daily basis by Bad Guys looking for a place to load some naughty code. What I did find interesting was the formatting of the IP address. Note the space before the 16 in 210.154. 16.12

I'm not into hacker stuff generally but I was intrigued by this one. Does anyone know how you get an IP address to include a space character?
.