I would guess that the Resent-From header is causing the problem.  If you
can determine that the Resent-From address for a given subscriber is the
same on every message, I would take Rich's advice: add that address as a
subscriber and set it to NOMAIL.

--
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame
[log in to unmask]


On 2/26/2009 5:35 PM, Randy Klumph wrote:
> This is from one sent directly to me...
>
> Return-path: <[log in to unmask]>
> Received: from cougar.WOU.EDU ([140.211.127.100])
>  by sundown.wou.edu (Sun Java System Messaging Server 6.2-8.04 (built Feb 28
>  2007)) with ESMTPS id <[log in to unmask]> for
>  [log in to unmask]; Wed, 25 Feb 2009 14:00:07 -0800 (PST)
> Received: from scarface.wou.edu (scarface.wou.edu [140.211.127.107])
>         by cougar.WOU.EDU (8.14.2/8.14.2) with ESMTP id n1PLxwrR006004  for
>  <[log in to unmask]>; Wed, 25 Feb 2009 14:00:02 -0800
> Received: from scarface.wou.edu (localhost.localdomain [127.0.0.1])
>         by localhost (Email Security Appliance) with SMTP id C07A58512AE_9A5C01FB       for
>  <[log in to unmask]>; Wed, 25 Feb 2009 22:03:11 +0000 (GMT)
> Received: from sniper25.usinternet.com
>  (sniper25a.usinternet.com [216.17.3.247])      by scarface.wou.edu
>  (Sophos Email Appliance) with ESMTP id 59F308512A0_9A5C01FF    for
>  <[log in to unmask]>; Wed, 25 Feb 2009 22:03:11 +0000 (GMT)
> Received: from smtp-out-02.usinternet.com. (216.17.3.61)
>         by sniper25.usinternet.com (Securence); Wed, 25 Feb 2009 15:59:55 -0600 (CST)
> Received: from localhost (localhost [127.0.0.1])        by smtp-out-02.usinternet.com
>  (Postfix) with ESMTP id 5DBF12327D     for <[log in to unmask]>; Wed,
>  25 Feb 2009 15:59:58 -0600 (CST)
> Received: from smtp-out-02.usinternet.com ([127.0.0.1])
>  by localhost (smtp-out-02.usinternet.com [127.0.0.1])
>  (amavisd-new, port 10024) with ESMTP id 04576-03 for <[log in to unmask]>; Wed,
>  25 Feb 2009 15:59:58 -0600 (CST)
> Received: from SONY (206-55-189-204.usiwireless.com [206.55.189.204])
>         by smtp-out-02.usinternet.com (Postfix) with ESMTP id 3A0AC23275        for
>  <[log in to unmask]>; Wed, 25 Feb 2009 15:59:52 -0600 (CST)
> Date: Wed, 25 Feb 2009 15:59:53 -0600
> Resent-from: [log in to unmask]
> From: Leslie Peterson <[log in to unmask]>
> Subject: RE: PLS CK DBM?? Re: My emails can not access DBM
> In-reply-to: <[log in to unmask]>
> To: 'Randy Klumph' <[log in to unmask]>
> Resent-message-id: <[log in to unmask]>
> Message-id: <78726E959B33403EBE46147227211C16@SONY>
> MIME-version: 1.0
> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
> X-Mailer: Microsoft Outlook, Build 10.0.6838
> Content-type: text/plain; charset=US-ASCII
> Content-transfer-encoding: 7bit
> Importance: Normal
> X-Priority: 3 (Normal)
> X-MSMail-priority: Normal
> Thread-index: AcmWCB3D5GkLmBcES0Opw3Zc8cRhfQBisMNg
> X-Virus-Scanned: amavisd-new at usinternet.com
> X-Securence-ID: 1235599195582-025-007602
> X-Securence-Country-Code: US - UNITED STATES
> X-Securence-odset: main.outbound.usinternet.com
> X-Securence-RFC2821-MAIL-FROM: [log in to unmask]
> X-Securence-RFC2821-RCPT-TO: [log in to unmask]
> X-Securence-REMOTE-HOST: smtp-out-02.usinternet.com.
> X-Securence-REMOTE-ADDR: 216.17.3.61
> X-Securence-Orig-To-Header: To: "'Randy Klumph'" <[log in to unmask]>
> X-Securence-pp1t: 8
> X-Securence-trat: 96
> X-Securence-omc: 0
> X-Securence-tsist: 104
> X-Securence-urt: 73
> X-Securence-art: 0
> X-Securence-drt: 177
> X-Securence-Info:
>  d-116;otrpq-0;otrp-1;opp1q-102;opp1-1;osrbq-3;osrb-0;ous1q-0;ous1-84;ovxrq-102;ovxr-44;oclmq-60;oclm-104;ovrcq-23;ovrc-0;ophcq-88;ophc-0;isdq-100;isd-0;vacq-105;vac-0;fsdq-19;fsd-2;dddq-101;ddd-0;cldq-95;cld-3;lrdq-106;lrd-1;dspq-62;dsp-0;ddrq-19;ddr-3;dmqq-2;s-956;t-1072
> X-Sophos-ESA: [scarface.wou.edu] 3.0.6.0, Antispam-Engine: 2.6.1.350677,
>  Antispam-Data: 2009.2.25.214330
> Original-recipient: rfc822;[log in to unmask]
>
>
>
> ----- Original Message -----
> From: Jacob Haller <[log in to unmask]>
>
>> Hmm, this seems strange.  Can you share the full headers from a
>> message that has gone through Securence?
>