Removed e-mail address/mailbox Other Staff receiving their e-mails

My Apologies for my late response, I have been on a leave of absence due to injury.
To answer your questions listed above:

This question was written to discover how to control the flow of SPAM my company receives.
The SPAM in question displays in the HEADER an unknown user recipient and these e-mails continue being received by Exchange 2010 and then sent to actual users and distribution lists.  

1.  Under disconnected Mailboxes there are no e-mail accounts listed.
However I did run the Purge command to make sure there were no hidden mailboxes.

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

2.  I ran the command to list all mail enabled SMTP address.  the user:   unknownuser@domain.org   Does not exist.
Get-Recipient -ResultSize unlimited | select Name -expand emailaddresses | Select SmtpAddress >  c:\temp\emails.txt

3.  The e-mail to the unknown user is received by multiple users and distribution lists.   Have checked the properties of these recipients and there is no other names listed in their exchange profile.  Verified thru ADSI Tool also.

4.  If Exchange 2010 is receiving an e-mail for an unknown user.    unknownuser@doman.org   is there a log on what Exchange is thinking when it determines what user to send this e-mail to ?    

Is there anything I am missing that I can try ?

Follow up Question:
In regards to #2.   If I can list all SMTP address, is there a way to also list what account the SMTP address is associated to ?
This would be to determine if an user e-mail account has multiple SMTP address attached to it.

The Script helped with identifying email accounts with associated e-mail address, however, still trying to figure out the routing of mail thru exchange with a bogus "TO" e-mail address.    Will continue to investigate.  Thanks everyone