Another possibility is squid (web proxy server). If you don't have squid set up to deny outsiders (this is enabled by default, but you may have inadvertently disabled it), they could spam that way. I ...

Sometimes, you will only find one “Received:†line in the headers. This is because some spam software runs the outgoing mail server right on the spammer’s PC (so they can avoid anti-bulk-email ...