> Can anyone enlighten me on how you poke around and figure this all
> out? I'm going through my logs and I'll check out the usual spam
> pages, but I'd appreciate any help.

I guess I should answer your question instead of being clever.   Sigh.

I realized that the guy sent the mail from ``KAT'' with no domain when
I noticed messages from several people on the mailing list who thought
the spammer had spammed from *their* domain.   I happen to know that
sendmail will, if configured (in?)correctly, append the local domain
to the end of unqualified addresses that it receives.   From there it
was obvious.   It probably didn't hurt that I'd run into a similar
problem with a non-spam message recently.

			       _MelloN_