Possible forgery that gets around mailhost system?

[Stormblade]

Was sending some reports, and noticed this one was weird. I didnt send it as I wasnt sure it was correct. The first 2 entries were fine, but after that it looked like the system misidentified 3 and 4 as Roadrunner..

1: (is OK)

2: Received: from rrcs-nys-24-97-120-139.biz.rr.com (rrcs-nys-24-97-120-139.biz.rr.com [24.97.120.139]) by ncmx01.mgw.rr.com (8.12.10/8.12.8) with SMTP id i5I4O1aw014801; Fri, 18 Jun 2004 00:24:02 -0400 (EDT)
Hostname verified: rrcs-nys-24-97-120-139.biz.rr.com
RoadRunner received mail from RoadRunner ( 24.97.120.139 )

3: Received: from %RNDLCCHAR312%RNDDIGIT13.globetrotter.net (20.142.24.146) by %RNDLCCHAR13%RNDDIGIT13-%RNDLCCHAR13%RNDDIGIT13.globetrotter.net with Microsoft SMTPSVC(5.0.2195.6824); Fri, 18 Jun 2004 02:14:51 -0300
No unique hostname found for source: 20.142.24.146
RoadRunner received mail from RoadRunner ( 20.142.24.146 )

4: Received: from Ernie%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13 (244.160.57.212) by %RNDLCCHAR315%RNDDIGIT13.globetrotter.net (InterMail vM.5.01.06.05 %RNDDIGIT3-%RNDDIGIT3-%RNDDIGIT3-%RNDDIGIT3-%RNDDIGIT3-%RNDDIGIT59) with SMTP id <%RNDDIGIT916.%RNDUCCHAR25%RNDDIGIT23.%RNDLCCHAR57%RNDDIGIT13%RNDDIGIT13.globetrotter.net[at]demodulate%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13%RNDDIGIT13%RNDLCCHAR13> for <x>; Fri, 18 Jun 2004 02:18:51 -0300
Internal handoff at RoadRunner

The message in question is http://www.spamcop.net/sc?id=z520695579zce...af3ed6d53ac406z

[StevenUnderwood]

This is one you definitely should send to the deputies attention per Ellens request in this Pinned item.

[Stormblade]

Already sent