Update - May 2006
I've still not done anything about the catchall on my domain and once again I find myself the victim of a spammer faking email as though it came from my domain. I have almost completed building a new server and I will be making changes like that once completed.
Today I received an interesting auto-reply from someone that was a recipient of the current round of spam, and that reply came back to my catch all account. Obviously this person has no understanding of the concept of dictionary based spam blasts. I thought about leaving their email address in the source of the message but seeing as they dont use this address it wont do any good.... and I'm not that vindictive any way :P
Reproduced below is the message source of the response to the spam:
Update - Feb 2006
I didn't learn my lesson and I kept the catch all running - but soon I will be upgrading the mail server and the new installation of SpamAssassin will be deleting anything marked as Spam. I've had no false positives since installing it over a year ago so I feel completely comfortable in doing this. A couple of weeks ago I received spam addressed to literally.anything@zenmaedia.com. Obviously the harvesting spiders are still at work... and someone somewhere has a link to this page.
Not Happy Jan!
For the last year this domain has been used solely as an email domain. Today (18-Jul-2005) it was used for the faked return address for a spam blast. I have a catch all on the domain so literally.anything@zenmaedia.com is received. Needless to say after this effort I will be seriously reconsidering the catchall.
Recreated below is the exact source of one of the original spam messages that was sent. Thankfully the server that bounced it due to it being directed at a non-existant recipient left the headers intact and attached the original message to their bounce. As you can see below the message appears to have originated from the girl-mail.com mailserver. The IP address against it traces back to a canadian cable ISP. Most likely one of their customers has been trojaned or is running an open relay but the bastards faked my address and I'm not happy. Needless to say I've reported it to a few of the spam relay report sites.
I would like to point out that I have never heard of, nor gone by, the name Earlene Frost and the email address that is listed as the from address does not exist on this domain.