[OT] Pilot Email Question

[Ben Pfaff]

Don Chorman <chormand@pilot.msu.edu> writes:

[spam]

> Thanks Ben. I did call CIC, and email them the header if thats worth
> anything. It looked like the email originated from campus.

I cannot speak as to your particular spam, since I haven't seen
it, but beware of depending on From: lines, etc., for domain of
origination.  For such things, spammers often just use a
"username" without any domain at all, and lots of MTAs (all?)
will then append their own domain.  So the spammer sends an email
through Pilot that has a From: line like:
	From: imbecile
and after it goes through Pilot, it looks like
	From: imbecile@msu.edu
which, if you don't read the Received: headers, makes it look
like it originated locally.