It got caught by my filter, i e, anything not addressed to me. Came from a zombied comcast machine. This is a straight-out Sam Spade output. I will annotate . Enjoy:

11/21/05 18:02:41 Input
The Received: headers are the important ones to read

My comments are just hints, and should be considered only <<
an opinion. I may have guessed wrong, or things may have
changed since I was written

From - Mon Nov 21 17:57:39 2005
Hmmm from isn't a header I recognise
X-Account-Key: account2
X-UIDL: 1eEjOY1f33Nl34p0
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
Status: U
Return-Path:
Received: from qhobb.gov ([67.189.220.215]) by
mx-limpkin.atl.sa.earthlink.net (EarthLink SMTP Server)
with SMTP id 1eEjOY1f33Nl34p0 Mon, 21 Nov 2005 17:07:31
-0500 (EST)
This received header was added by your mailserver
mx-limpkin.atl.sa.earthlink.net received this from someone claiming
to be qhobb.gov
This doesn't match the IP address in the headers, so this
may be a relay point. If so all headers below are probably
forged.
It really came from c-67-189-220-215.hsd1.nh.comcast.net <<

From: [email protected]
To: [email protected] <<<<<<
Earthlink is a legitimate ISP and have many legitimate
customers. They have reduced their spam problem significantly recently.
They blame the problems on uunet, usually.

Date: Mon, 21 Nov 2005 20:57:34 UTC
Subject: You visit illegal websites
Importance: Normal
Hmmm importance: isn't a header I recognise
X-Mailer: SpeedMail_V7.61
X-Priority: 3 (Normal)
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="======2d3c610d2bf.40f8d0fcfafe"
Content-Transfer-Encoding: 7bit
X-ELNK-AV: 0

This is a multi-part message in MIME format.

--======2d3c610d2bf.40f8d0fcfafe

Dear Sir/Madam,

we have logged your IP-address on more than 30 illegal Websites.

Important:
Please answer our questions!
The list of questions are attached.


Yours faithfully,
Steven Allison



*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
--======2d3c610d2bf.40f8d0fcfafe
Content-Type: application/octet-stream; name=question_list.zip
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="question_list.zip" <<<<<<<