[Esd-l] Bounces go to wrong people

[Victor]

Hi. I am faced with this issue: a spam message comes in with a .bat 
attachment, but the Reply-To: header is set to some legit user on yahoo. 
So they get tons of "SECURITY WARNING" messages even though they sent 
nothing. Any of you guys faced this situation? Any clues as to what I 
can do here? I know that From: can be forged too, but stopping this 
notice from going out at all gives no notice to those who just 
accidently send unallowed extensions and then wonder why their mail 
didn't arrive...

Anyone faced this?