While it is not always clear whether the anti-virus scanners
are talking about the RFC822 From: / To: addresses or the RFC821 SMTP
MAIL FROM / RCPT TO, I suspect they mean the RFC822 headers.  And in
that case mail from your list does NOT have the address in the From:
header - it is in the To: header.  Of course Klez and the like just
grabs pairs of addresses and don't know better.