When an email is sent to generate an incident, the user might copy one or more distribution lists. All recipients of the orignal email get added to the watchlist, including any distribution lists. However, the actual users within the distribution lists are not added to the watchlist.. After all, ServiceNow has no insight into who is and is not in the distribution list. A user from the distribution list might "Reply All" to the original email. When this occurs, if the user does not have an ITIL license, the incoming email will generate a new incident because the user does not have access to the original incident (the user is not the Opened By, Caller and is not technically in the watchlist). Has anyone else run into this issue? If so, how did you fix it?
