Outlook Mail Redirection

[Altair]

Ok, this is a little confusing to try and explain, but I'll do my best. I have replaced the email addresses in the headers to keep my clients email address secure.

SOMETIMES when my client sends and email, he will receive a bounce saying that the server couldn't deliver the message to some random email address. The email addresses that the server is trying to reach have never been associated to their domain in any way (not by me anyway).

It's almost like some kind of email capture is taking place, but they are the only clients I have that report this problem.

They use Outlook 2000. This particular person is using Outlook 2003.

I thought maybe it was some kind of spyware or something on their machines, but this latest bounce is a little strange... "testing@unix3.hsphere.cc"

Any thoughts or ideas would be helpful.

P.S. They tell me that they have run both virus scanner and spyware scanner on the machines and found nothing.


-----------------------HEADER INFO----------------------
From: MAILER-DAEMON@forward.hsphere.cc
[mailto:MAILER-DAEMON@forward.hsphere.cc]
Sent: Tuesday, August 29, 2006 8:37 AM
To: emailaddress@theirdomain.com
Subject: failure notice
Hi. This is the qmail-send program at forward.hsphere.cc.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<testing@unix3.hsphere.cc>:
Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
I'm not going to try again; this message has been in the queue too long.

<testing@unix3.hsphere.cc>:
Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.
Return-Path: <emailaddress@theirdomain.com>
Received: (qmail 25519 invoked from network); 29 Aug 2006 15:37:17 -0000
Received: from mail6.hsphere.cc (216.157.145.26)
by forward.hsphere.cc with SMTP; 29 Aug 2006 15:37:17 -0000
Received: (qmail 3792 invoked by uid 399); 29 Aug 2006 15:37:16 -0000
Received: from unknown (HELO NNICORA)
(emailaddress@theirdomain.com@72.18.227.34)
by mail6.hsphere.cc with SMTP; 29 Aug 2006 15:37:13 -0000
From: "First Last" <emailaddress@theirdomain.com>
To: "First Last" <emailaddress@theirdomain.com>,
"First Last" <emailaddress@theirdomain.com>,
"First Last" <emailaddress@theirdomain.com>,
"First Last" <emailaddress@theirdomain.com>
Subject: Laredo Bound Truck- Depart: 8/28 Arrive: 9/1
Date: Tue, 29 Aug 2006 08:37:01 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0049_01C6CB46.4DB49F70"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
X-MS-TNEF-Correlator: 0000000000C81F0899B7DC49B3D9395F1AE84592A4A42800

Thread-Index: AcbLgPhO/3mLVrSNS8y9vphev1y04w==
This is a multi-part message in MIME format.

------=_NextPart_000_0049_01C6CB46.4DB49F70

Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

[generic]

is that a form on their site, otherwise I dont see why its coming from or trying unix3. if its a form that may have a email address left over from when the developer built the form.. i.e. testing...

[Altair]

Unfortunately, no it isn't a form on their site.

The bounces happen when my client send email from his email program

I know... Doesn't make any sense. I have him forwarding all of these bounces that he gets. I am attempting to find some sort of pattern, but as of yet I can't see one.