That may be true, however I have seen different interpretations of this. Nevertheless, I am not an expert and cannot say for certain. My "interpretaion" based on Microsoft's example is different from yours. Their examples continue to show user1 (requires a CAL) accessing data and then emailing it to user2 (no CAL required). They do NOT ever mention the server emailing it directly to someone. My interpretation is that the server itself is doing the emailing and is acting as user1 who then emails a report to user2 (who does not require a CAL). Again, interpretation best left to people who can argue it in front of a judge.