>The only legitimate reasons for a difference between "HELO" and >"CONNECTED TO:" might be a firewall or proxy or a load balancing scheme >involving multiple mail
Also for some users the CONECTED TO: would be there providers domain name who is doing the mail forwarding rather than there own domain. So this also makes it difficult to compare the two and assume that if the two didn't match it was SPAM.
