Email address - anyone heard of this one?

[MikeBCda]

Hi,

I'm well aware that some email viruses "borrow" the from and/or to addresses from the addy book in the process of distributing themselves. But I always thought the address was picked up complete, rather than in "pieces".

I frequently forward copies of Nigerian Letters and related stuff to the Phonebusters unit (joint RCMP-OPP operation). Last night I got a failed-delivery notice relating to one of those, for one I'd sent them -- it was showing delivery attempted to "wafl@" (so far correct) at a totally different domain. The message body, and even my original "To" address, were still there and were correct.

I use Eudora 6 (under XP-Home, all critical updates), and avast (both resident and on-demand) and Ad-Aware both showed clean, and not a peep out of SpywareGuard.

Anyone ever heard of this before, the mix-and-match of a name and an unrelated domain? It's entirely possible, of course, that it was a freak mailer-daemon glitch rather than any kind of malware -- I re-sent the latest version, complete with failed-delivery notice, and they apparently received that one ok.

Any comments or suggestions would be appreciated. There's been no other oddball behavior to suggest any kind of malware.

Thanks and best,
Mike