Return-Path: <2a2rs@fiol.brock.dk>
Received: from correo.uaa.mx ([148.211.1.1])          
by SantaClara01.pop.internex.net (Post.Office MTA v3.1.2          
release (PO203-101c) ID# 0-34792U7500L7500S0) with SMTP          
id AAA1472 for <chris@lanets.com>;          
Sun, 21 Dec 1997 23:20:12 -0800
Received: from 1Cust71.tnt1.thousand-oaks.ca.da.uu.net by correo.uaa.mx with SMTP	(1.38.193.5/16.2) 
id AA16571; Mon, 22 Dec 1997 01:19:09 +0600
Date: Mon, 22 Dec 1997 01:19:09 +0600
To: 2a2rs@fiol.brock.dk
From: 2a2rs@fiol.brock.dk (BC)
Comments: Authenticated sender is <2a2rs@fiol.brock.dk>
Reply-To: 2a2rs@fiol.brock.dk
Subject:  24 Hour CASH Grab is on....
Message-Id: <199712223905VAA39682@post.uaa.mx>

148.211.1.1 resolves to: aqua.uaa.mx
correo.uaa.mx resolves to: 148.211.1.1
OK, this is definately the relaying server. Looks like hijacking to me.

1Cust71.tnt1.thousand-oaks.ca.da.uu.net resolves to: 208.254.79.71
I am suspecing forgery at this level because of the lack of IP addressing that is usually present.

Well, that's awfully short.