I have Read Receipts disabled, but one was generated when MY address is in Disposition-Notification-To

It is possible for spam messages to create that perception as an attempt to bypass spam checkers. Thunderbird will not send you a message on its own.

Thanks for the response. However, if this Read Receipt was not generated by Thunderbird, the only other explanation is that it was generated by Microsoft's servers. It arrived shortly after I read the original spam message and was sent to my mail server (Microsoft) and delivered to my inbox. (And the headers show no "Received:" lines other than Microsoft servers). I still think the most likely explanation is that this is a bug in Thunderbird. Is there a more appropriate place to report this issue? I can provide the entire spam message - and the read receipt that was generated. Thanks.

You can report it at bugzilla.mozilla.org, but you need to be sufficiently specific so that it can be investigated. You're asking from where a spam message came, and that is quite vague.

OK. Thanks. I'll look into bugzilla. However, I'm not asking where the spam message came from. I'm asking about the Read Receipt that was generated when I read the spam message.

re :Thunderbird generated an email (to me) and sent it to my mail host.

No it didn't. That's impossible. I've had loads of these types of emails in various formats over the past couple of decades. It's just a spam email from an unpleasant person.

Some nefarious person had sent you an email and altered the data so it looks like it was sent by you. They do that because it gets past the spam filters - after all you are not going to setup your own email address as spam nor are you going to mark it as spam for same reasons. So in nutshell the sender knows it will get into your Inbox.

If you view the source code you will find it says something very different. The 'Received by' entry that's immediately above the from, to date subject headers is the first server and it probably implies the email was received from someone else maybe using a mailing service.

The 'Read Receipt' "Disposition-Notification-To" was generated by the person who sent the emails in the first place, they asked for it. That's what you would see if anyone asked for a 'Read receipt'. The sender is just trying to get you to either click on it or is hoping your email client setup would send an auto response to a Read Receipt. The sender is just trying to get an auto conformation that your email address is legit and live. There is no bug. Delete the email and then compact the folder to remove all traces of it.