I just wanted to leave a note here. The problem that Mark was facing was due to his backup MX server. When you have a backup MX server which sends mail to a primary server, you need to add an IPBYPASS line in Declude's global.cfg file for the backup MX. In Mark's case, his backup MX was sending along spam messages to his primary server and since he did not have an IPBYPASS line in his global.cfg on his primary server, Declude was not able to see the IP of the real sender. Instead it saw all mail coming from the backup MX IP. I had Mark add a line in his global.cfg which bypasses his backup MX. In other words, adding an IPBYPASS for the backup MX allows Declude to hop backwards over the backup MX and see the IP of the real sender. Also, I suggested that Mark add Declude (it's free) to his backup MX server to help stop spam from coming in the first place. Just wanted to let everyone know what we did here to resolve his issue just in case any of you are having the same issue.