In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt:
Consider an implementation of this protocol, with the additional feature of confirmation messages. Whenever Bob receives a message, he returns it as a confirmation of receipt. 1. Alice signs a message with her private key, encrypts it with Bob’s public key, and sends it to Bob.
2. Bob decrypts the message with his private key and verifies the signature with Alice’s public key, thereby verifying that Alice signed the message and recovering the message.
VA(DB(EB(SA(M)))) = M
3. Bob signs the message with his private key, encrypts it with Alice’s public key, and sends it back to Alice.
4. Alice decrypts the message with her private key and verifies the signature with Bob’s public key. If the resultant message is the same one she sent to Bob, she knows that Bob received the message accurately. Assume that Mallory is a legitimate system user with his own public and private key. Now, let’s watch as he reads Bob’s mail. First, he records Alice’s message to Bob in step (1). Then, at some later time, he sends that message to Bob, claiming that it came from him (Mallory). Bob thinks that it is a legitimate message from Mallory, so he decrypts the message with his private key and then tries to verify Mallory’s signature by decrypting it with Mallory’s public key. The resultant message, which is pure gibberish, is:
EM(DB(EB(DA(M)))) = EM(DA(M)) 
Even so, Bob goes on with the protocol and sends Mallory a receipt:
Now, all Mallory has to do is decrypt the message with his private key, encrypt it with Bob’s public key, decrypt it again with his private key, and encrypt it with Alice’s public key. Voilà! Mallory has M.
The message that Mallory recorded is: EB(SA(M))
But why the DA in formula  and 
I think if Mallory want to 'steal' the origin message M, he should do the following steps:
- Mallory receive the encrypted message as a confirmation of receipt from Bob : EM(SB(VM(DB(EB(SA(M)))))) = EM(SB(VM(SA(M)))) = X
- Then Mallory have to decrypt X with his private key : DM(X) = SB(VM(SA(M))) = X1
- And then verifies X1 with Bob's public key : VB(X1) = VM(SA(M)) = X2
- And then encrypt X2 with his private key EM(X2) = SA(M) = X3
- finally, verifies X3 with Alice's public key VA(SA(M)) = M
Can any one point out my mistake?