Maybe in this case you were being sharked, but before we got everything clamped down on our servers we saw a number of spammers who were 'multi- hopping' their UCE and including faking headers and sending false HELO data.

That reminds me, I've seen spammers using SMTP route-addrs, which would create this multi-hop effect through multiple relays. -- Scott Hazen Mueller zorch@wenet.net +1 415 281 6550 x269 Vice President Engineering, Whole Earth Networks (Hooked and The Well)