Spammers are nothing if not innovative. Each time you come up with a method for blocking them, they find a way around it. One of the most restrictive policies for filtering out spam is to use whitelists – which means only mail from those addresses you specify (trusted entities such as your family members, friends and companies with which you want to do business) will be accepted. All other mail will be rejected. Yet even whitelists can’t keep all the spam out, because spammers can find ways to compromise those trusted accounts and use them to send spam to you. Since the mail comes from an address on the whitelist, it gets through.
Recently there have been reports of spam coming from legitimate Hotmail accounts, but all web mail systems are vulnerable to this type of address spoofing (and non-web mail accounts aren’t immune, either). This short article shows you how to identify whether mail is really from a legitimate sender or the address is spoofed, and discusses how the spoofing occurs and what victims can do about it: