Все эти заголовки будут совпадать, только если письмо уходит через нормальный SMTP-клиент. А спамеры, конечно же, этого не делают.
Behold:
$ telnet mail.whitequark.org 25
Trying 2002:59b3:f5e8::1:1...
Connected to mail.whitequark.org.
Escape character is '^]'.
EHLO mannaz
220 mail.whitequark.org ESMTP Postfix (Debian/GNU)
250-mail.whitequark.org
250-PIPELINING
250-SIZE 100000000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<spammer@we.do.the.abuse>
250 2.1.0 Ok
RCPT TO:<whitequark@whitequark.org>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: a.completely.unrelated@address
This is a text full of marketing crap.
.
250 2.0.0 Ok: queued as DA39E6F5CD
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
Return-Path: <spammer@we.do.the.abuse>
X-Original-To: whitequark@whitequark.org
Delivered-To: whitequark@whitequark.org
Received: by mail.whitequark.org (Postfix, from userid 107)
id DA7AC38; Sun, 27 Feb 2011 22:11:18 +0300 (MSK)
Received: from mannaz (unknown [IPv6:2002:59b3:f5e8:0:225:d3ff:fe78:6a75])
by mail.whitequark.org (Postfix) with ESMTP id DA39E6F5CD
for <whitequark@whitequark.org>; Sun, 27 Feb 2011 22:09:49 +0300 (MSK)
From: a.completely.unrelated@address
Message-Id: <20110227191119.DA7AC38@mail.whitequark.org>
Date: Sun, 27 Feb 2011 22:11:18 +0300 (MSK)
To: undisclosed-recipients:;
This is a text full of marketing crap.
(X-Original-To пихает, если не ошибаюсь, virtual rewrite map в postfix-e)
