Ah, sounds like you don't know about from addresses: they are specified by the sender, and not authenticated. A spammer can send email that appears to be from anyone else, until you look at the validated headers (like "Return-path:").