I'll just make this one comment, as I think this whole thread is probably
off-topic, but this tactic has been used for quite some time by spammers.
Even if they aren't using a version with the bogus timestamp, following the
headers down, the forged line becomes obvious when you realise that the psi
host never received it from bothere.net, plus there *is* no bothere.net.
For further information on this topic, I would suggest either the spam-l
mailing list, or send mail to spam-request@zorch.sf-bay.org. Many of these
issues have long been hashed, and current topics on the spam problem are
more properly discussed on one of those lists.
Steve Mansfield steve@nwnet.net
NorthWestNet Network Engineer 425-649-7467