And don't be fooled by "Received:" entries below the first transaction with your server. They can also be spoofed. A spammer to my work address enjoys using dictionary-picked words to create fake hostnames for that part of the header.