spam drones

[NuclearNed]

I just got a spam email from an address that looks like this:

JohnDoe@NuclearNedsCompany.com

John Doe is a real guy who works here, and this is his actual email address. Is it possible/probable that his pc has been taken over as a spam drone? What would I look for if I wanted proof of a takeover?

 

[Capt Caveman]

Run a spyware program on his pc.

 

[iamwiz82]

Watch traffic coming off of his PC on port 25.

 

[NuclearNed]

Originally posted by: iamwiz82
Watch traffic coming off of his PC on port 25.

25 exclusively?

 

[jiggahertz]

You can fill in the from header on an email with anything you want, doesn't mean it's being done from this person's PC.