The "From" address that is included in the current headers is set by the user and can certainly be spoofed. What I'm suggesting is having the ISP add the default e-mail address (or some other account-specific information) after the e-mail has left the user and before it leaves the ISPs server, just as the sending IP address is added. This would allow the origination point to be narrowed down to more than just the server, but to the actual account on that server.

Eliz.