I occasionally get SPAM where my email address appears in the "From" field, with the real email address of the sender. In this case, the Norton SPAM Outlook plug-in asks me if I want to block my own email address. Here is the header info from one example:
Received: from MBX15D-ORD1.mex06.mlsrvr.com (172.29.1.44) by
MBX15B-IAD3.mex06.mlsrvr.com (172.29.33.44) with Microsoft SMTP Server (TLS)
id 15.0.1293.2 via Mailbox Transport; Fri, 20 Oct 2017 06:16:23 -0400
Received: from MBX05C-ORD1.mex06.mlsrvr.com (172.29.1.13) by
MBX15D-ORD1.mex06.mlsrvr.com (172.29.1.44) with Microsoft SMTP Server (TLS)
id 15.0.1293.2; Fri, 20 Oct 2017 05:16:23 -0500
Received: from gate.forward.smtp.ord1a.emailsrvr.com (173.203.2.22) by
MBX05C-ORD1.mex06.mlsrvr.com (172.29.1.13) with Microsoft SMTP Server (TLS)
id 15.0.1293.2 via Frontend Transport; Fri, 20 Oct 2017 05:16:23 -0500
Return-Path: <name@domain.org>
X-Spam-Exception: WHITELISTED
X-Spam-Threshold: 95
X-Spam-Score: 100
Precedence: junk
X-Spam-Flag: YES
X-Virus-Scanned: OK
X-MessageSniffer-Scan-Result: 57
X-MessageSniffer-Rules: 60-324727-1179-1214-m
60-324726-1179-1214-m
57-244405-1494-1563-m
57-383862-1673-1694-m
57-244405-1907-1976-m
57-244404-1928-2023-m
57-383862-2086-2107-m
57-244405-0-2143-f
X-CMAE-Scan-Result: 100
X-CNFS-Analysis: v=2.2 cv=J/Ho10vS c=1 sm=1 tr=0 p=MfbvB/eUoym3SzWRKP02IA==:17 p=4ylPOyEGAAAA:8 p=wp-F__g3xvj3f_yxF8EA:9 a=MfbvB/eUoym3SzWRKP02IA==:117 a=8nJEP1OIZ-IA:10 a=wPNLvfGTeEIA:10 a=a6pySZrTaj9vEKguGWk-:22
X-Orig-To: name@domain.org
X-Originating-Ip: [123.143.141.132]
Authentication-Results: smtp26.gate.ord1a.rsapps.net; iprev=pass policy.iprev="123.143.141.132"; spf=permerror smtp.mailfrom="name@domain.org" smtp.helo="[123.143.141.132]"; dkim=none (message not signed) header.d=none; dmarc=none (p=nil; dis=none) header.from=domain.org
X-Classification-ID: b8607f08-b57f-11e7-9e01-00221925465a-1-1
Received: from [123.143.141.132] ([123.143.141.132:60125] helo=[123.143.141.132])
by smtp26.gate.ord1a.rsapps.net (envelope-from <foo@domain.org>)
(ecelerity 4.2.1.56364 r(Core:4.2.1.14)) with ESMTP
id FE/DA-27895-6FCC9E95; Fri, 20 Oct 2017 06:16:22 -0400
Date: Fri, 20 Oct 2017 10:31:26 -0800
From: "foo@domain.org" <name@domain.org>
X-Priority: 3
Message-ID: <911554977.201710201108@domain.org>
To: <name@domain.org>
Subject: Earn 150.000 Usd Per Month So Easy
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-MS-Exchange-Organization-Network-Message-Id: 5c83c42d-46db-4b93-1373-08d517a39d66
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXzs^g;1372700;0;This mail has
been scanned by Trend Micro ScanMail for Microsoft Exchange;
X-MS-Exchange-Organization-SCL: 0
X-MS-Exchange-Organization-AuthSource: MBX05C-ORD1.mex06.mlsrvr.com
X-MS-Exchange-Organization-AuthAs: Anonymous