Any point disabling 'who'?

[David Coles <davidc @ southern . com>]

Hello.

I'll probably get flamed for this, but I can't see anything in the FAQ
etc.

It is possible to disable the 'who' command - fine.
However, surely it's still possible to see who's on the list with the EXPN
command to sendmail.

Is there any way of stopping this (other than disabling EXPN in sendmail -
would that be against some RFC or other)?

Thanks.

-David Coles