How about using SMTP AUTH and verifying the envelope MAIL FROM to match the actual user authenticating? This will make SPAM traceable and hopefully ultimately users aware that their PC is sending junk. Adi