It's tough to do. The best thing would be to change your admin email address and to turn off all catch-all email for that domain. I had one that was so abused in that manner that I had to remove the mx record for the domain. The email system needs to be upgraded so that the sender and return path cannot be spoofed.

Thanks for the reply, the problem is that I'm using a shared hosting plan with 5 of my other domains and killing the one email address also removes the non-abused addresses for my other domains. But I did change my password to make sure the messages are not coming through my mail server, so far that seems to be working but I'll know more after a day or two.

Here's the other thing. All of the bounced spam messages trace back to the same company and mailing address when I trace the domains contained in the body of the messages. Also, the originating IP for all of the original messages trace back to the same company and mailing address, at least so far.

Both are within the US which is where I am, so I'm wondering if a C&D letter from my attorney would help or just cause more trouble.

Here's another thing...

I've been saving all of the bounced spam notices because I've been spending some time reading about anti-spam laws. I am concerned that someone may try to sue me to stop the spam and if I don't have any proof that my email address has been spoofed I'm afraid I won't be able to defend myself.

I did find out that my email server was not being used. My outgoing mail was restricted to 2 recipients max and I am still getting bounced emails to 20 or more recipients.

Does anyone know of any legislation that provides recourse for people who's email addresses are spoofed? I know there is legislation to help people receiving spam, but what about us poor saps that are being framed?

I have some experience with this:

[news.com.com...]

I DID find the spammer. A hacker found him for me, after reading the cNet article, and asked that I give the reward to the Kevin Mitnick Defense Fund.

He was able to track them down using the phone number they were advertising. He was able to identify the service that leases the phone lines that were being advertised. I contacted them, and they gave the leasee 24 hours to stop the spam. (Else they would disconnect the line.) The fellow leasing the line claimed (and I beleive him) that he hired somebody to do marketing, but failed to ask enough questions about just HOW he was doing his marketing. I recieved two anonymous money orders in the mail totalling $800, which represented the entire profits of the spammer.