Looking through my logs it seems that a number of domains are doing what the original domain address is doing. In every case the from address(that claims to be from my server) is not a valid address on my server. It seems that someone has found a way to compromise the catchall setting in vpopmail, as the domains in question all have a catchall mail account.
If someone is forging a return address, but sending to some random address for that domain, there's not much you can do (other than turning off the catchall).
--
Tom Collins
[EMAIL PROTECTED]
