@rozzin that sounds like the evolution of spam origin analysis: first, all Received: headers were checked; but then it was seen that those could actually be spoofed, too - *except* for the origin machine of the last hop. Looks like SP…