How can I screen out addresses that are neither valid usernames or distribution lists on mail being forwarded to an internal Win2K server?

A user suggested using a router like this to do the recipient verification:

verify_user_router:
   driver = accept
   domains = win2kdomain.com
   local_parts=\
     ldap;user="cn=ldap-guest,cn=Users,dc=win2kdomain,dc=com"\
     pass=guest \
     ldap:://win2kpdc/dc=win2kdomain,dc=com?mailNickname?\
     sub?(&(mailNickname=$local_part)\
     (showInAddressBook=*)(sAMAccountName=*))
   verify_only

Set up ldap-guest as a normal domain user on the Win2K PDC. Also, you need to set no_verify on all the other routers that handle that domain.