In my experience the From field is always forged but the accurate
relaying address (i.e. the intermediate sender) is still in the header.
In Outlook and OE, right click the unopened message/properties/details
for header information. Thus there is someone to notify - assuming your
virus checker did not do so automatically.

On Tue, 26 Aug 2003 17:42:48 -0400, "Tom Ogilvy"
wrote:

the virus puts a fake/spoofed reply to addresses on the emails it sends
out. It can get the addresses from the actual infected users address book
or other vulnerable computers it can reach - it almost definitely didn't
come from the person shown in the reply to address or if you receive such a
notification (indicating you sent it) it wasn't you that sent it.