Looks like I'm in over my head again....the origin address appears to be "ukrtel.net". I'm not sure why this owner elected to make himself an editor of a one way announce only list. I have suggested that he remove that. Thanks for all the help. I am still looking..

-----Original Message-----
From: LISTSERV site administrators' forum [mailto:[log in to unmask]] On Behalf Of Paul Russell
Sent: Tuesday, December 22, 2009 11:09 AM
To: [log in to unmask]
Subject: Re: spam messages

On 12/22/2009 11:01, Paul Russell wrote:
> On 12/22/2009 10:45, Andrew Bosch wrote:
>> That is a tricky one. The spam sender could be any one of the editors or subscribers, assuming
>> that the spams he gets are not just coincidental. If he has access to the MTA logs, the SMTP 
>> transaction information could be revealing.
>>
> 
> Almost everything useful that he could find in the MTA log should also be
> present in the full message headers on the spam.
> 

Plus, the full headers will reveal the complete delivery path from the point of
origin - information which will not be available in the MTA log, if the message
originated from a system other than the one which delivered it to the MTA.

-- 
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame