> Can you confirm that this address security@microsoft.com is
> being monitored as well.

I once sent a bug to this address and got a response that indicated that it
was Microsoft Security, as in their campus police force. This was a couple
of years ago. I suppose for safety reasons, they might not want to change
it at this point.

-Francis