When using special characters like Pound/Hash (#) Plus (+) Equal(=) As because they are known to cause problems in group names. Add input validation to disallow this characters.
It is mentioned here:
But since there was a case where mails where routed incorrectly (automatically) by the system since (nested) groups contained Pound/Hash(#) characters in their name. Main-Group name e.g. #Group1 contained nested sub-groups e.g. #NestedGroup#12, #NesteGroup#22, etc. and one of those nested Groups was non-existent, the mailrouter automatically chose the first group the the "#" character in the name and forwarded the emails automatically to those members.
Luckily the information was not sensitive...