Here is a copy of the header I got from the user. It appears that the senders address has been forged with the receivers address.
Received: from mail.syncor.com (YWING [10.10.51.35]) by us-whl-e2.syncor.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id 3VBMCSA6; Sat, 13 Jul 2002 13:14:14 -0700 Received: from host101-228.pool22816.interbusiness.it (host101-228.pool22816.interbusiness.it [80.16.228.101] (may be forged)) by mail.syncor.com (Build 101 8.9.3/NT-8.9.3) with SMTP id MAA03382 for <[EMAIL PROTECTED]>; Sat, 13 Jul 2002 12:55:44 -0700 From: [EMAIL PROTECTED] X-Authentication-Warning: mail.syncor.com: host101-228.pool22816.interbusiness.it [80.16.228.101] (may be forged) didn't use HELO protocol Date: Sat, 13 Jul 2002 16:18:45 -0500 MIME-Version: 1.0 Message-Id: <[EMAIL PROTECTED]> X-Encoding: MIME Content-Type: multipart/alternative; boundary="----=_NextPart_1125_42721275202112618143383266572" Content-Transfer-Encoding: quoted-printable Received: from syncor.com by 0QRMDI33724O.syncor.com with SMTP for [EMAIL PROTECTED]; Sat, 13 Jul 2002 16:18:45 -0500 Importance: Normal To: [EMAIL PROTECTED] Subject: Keep porn free... X-Priority: 3 Reply-To: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]