Ok, sorry, just now saw this. antares65, I think you misunderstood a little about what I meant. When d.e.pollard sent you that email complaining about spam, he should have been able to send you the email he received, with its complete headers intact.

What I want should look something like this:

Received: from xx.xx.xx.xx ([xx.xx.xx.xx]) by xxx.xx.xx.xx with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72)
id CZVHLN7P; Mon, 12 Jan 2004 12:07:14 -0600
Return-Path: <[email protected]>
Received: from yy.yy.yy.yy ([yy.yy.28.5] [yy.yy.28.5]) by zz.zz.zz.zz with ESMTP for xxxxxx@xxxxxxxxxxxxx; Mon, 12 Jan 2004 18:07:08 Z
Received: from listserv.ihigh.com (listserv.ihigh.com [63.106.143.29])
by yy.yy.yy.yy (8.12.10/8.12.10) with SMTP id i0CI63SG028136
for <xxxx@xxxxxxxxxxxxxxxxx>; Mon, 12 Jan 2004 12:06:04 -0600 (CST)
Received: (from nobody@localhost)
by listserv.ihigh.com (8.9.3/8.9.3/SuSE Linux 8.9.3-0.1) id MAA19537;
Mon, 12 Jan 2004 12:57:18 -0500
Date: Mon, 12 Jan 2004 12:57:18 -0500
X-Authentication-Warning: listserv.ihigh.com: nobody set sender to [email protected] using -f
To: xxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx
Subject: WHITE OUT TOMORROW NIGHT
MIME-Version: 1.0
From: [email protected]
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>

This will usually provide enough information to determine who actually sent the spoofed email.

/nebulus