Maybe in this case you were being sharked, but before we got everything
clamped down on our servers we saw a number of spammers who were 'multi-
hopping' their UCE and including faking headers and sending false HELO data.
That reminds me, I've seen spammers using SMTP route-addrs, which would create
this multi-hop effect through multiple relays.