Matt,

Sorry for the firedrill - that is exactly what I'm concerned about, although on my site I only have one contact form with all the get data addslashed and htmlspecialchars filtered out, so I don't think any malicious scripts could be injected. Here is an example header -

Code:
Return-path: <>
Envelope-to: charles@harmonmediagroup.com
Delivery-date: Tue, 01 Apr 2008 21:35:22 -0400
Received: from [72.32.68.27] (port=60577 helo=90752-www2.kapowwe.com)
    by cpvps125-vern.harmonmediagroup.com with esmtp (Exim 4.68)
    id 1JgrsT-00013A-Do
    for charles@harmonmediagroup.com; Tue, 01 Apr 2008 21:35:21 -0400
Received: by 90752-www2.kapowwe.com (Postfix)
    id 303BB6AC6D3; Tue,  1 Apr 2008 20:35:08 -0500 (CDT)
Date: Tue,  1 Apr 2008 20:35:08 -0500 (CDT)
From: MAILER-DAEMON@kapowwe.com (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: charles@harmonmediagroup.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
    boundary="E914C6AC52E.1207100108/90752-www2.kapowwe.com"
Message-Id: <20080402013508.303BB6AC6D3@90752-www2.kapowwe.com>
X-Spam-Status: No, score=1.2
X-Spam-Score: 12
X-Spam-Bar: +
X-Spam-Flag: NO
And here is the return bounce header part

Code:
Reporting-MTA: dns; 90752-www2.kapowwe.com
X-Postfix-Queue-ID: E914C6AC52E
X-Postfix-Sender: rfc822; charles@harmonmediagroup.com
Arrival-Date: Tue,  1 Apr 2008 20:35:07 -0500 (CDT)

Final-Recipient: rfc822; austin@www.kapowwe.com
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; mail for www.kapowwe.com loops back to myself
So, it doesn't look like it is originating from me, does it? Or is there not enough info to tell. Funny thing that all of the sudden I got around 200 bouncebacks last night.

Charles