I've just found a new and interesting spam source - legitimate bounce messages

[Luke Dean]

On Thu, 16 Oct 2008, Matthew Seaman wrote:

> Until the wonderful day that the entire internet abides by these rules[*], 
> use
> of technologies like SPF and DKIM can discourage but not entirely prevent the
> spammers from joe-jobbing you.

I just started getting these bouncebacks en masse this week.
My mail provider publishes SPF records.
If the names and numbers in the bouceback messages are to be believed, 
however, the spammers have defeated SPF by hijacking DNS.  The poor 
recipients never see my SPF records because they're looking at the wrong 
IP address.