Making Light:  Open thread 23 ::: May 21, 2004, 12:03 PM

  Julai Jones:  Most likely scenario is that someone else who has both
  your addresses in their address book is infected - modern viruses
  typically forge the address to look as if they come from somewhere
  else.

Yes modern viruses forge the address, but not necessarily out of the
infected machine's address book.  I doubt that getting sender&receiver
addresses out of the same web page or newsgroup is not beyond the
state of the art.

  You'd need to check the headers and trace the IP address the virus
  came from.

In particular, the "Received:" lines describe the trail that the
message took from the last non-lying host.  It's not beyond a virus
to put in extra pebbles to lead you off the track.  I've been tracing
e-mail spam since 1994, and it just gets trickier.