Personally, I blame the anti-virus companies who market the software.
They know which viruses forge From: lines; why should their "alert the
poor infected fool" software send notes to folks whose addresses are
being spoofed?
--Steve Bellovin, http://www.research.att.com/~smb (me)
http://www.wilyhacker.com (2nd edition of "Firewalls" book)