While it is not always clear whether the anti-virus scanners are talking about the RFC822 From: / To: addresses or the RFC821 SMTP MAIL FROM / RCPT TO, I suspect they mean the RFC822 headers. And in that case mail from your list does NOT have the address in the From: header - it is in the To: header. Of course Klez and the like just grabs pairs of addresses and don't know better.