Looks to me the website's spam filters are not as robust as maybe others are. Time to look for a different filter supplier? Cleaning up after the fact must be a real pain at the moment. Has anyone noticed whether there are similar inbound ip's involved so that blocking xxx.xxx.*.* might be an option ?