>Notice that the "Connected To" system has a different name than the >"HELO" msg would indicate.
TeleFinder logs the "HELO" name, but does not use it. "sf-dnpqh-156.compuserve.net" is the name TF uses in spam blocking. It is possible that the client machine has both names, you'd need to do a complete NS lookup for that.
The "MAIL FROM" is whatever the client systyem provides, its not necessarily related to the headers in the message. I don't know if it is more likely to be different in SPAM or not.
