I didn't look further than the "received from" IP
Yes, I did subscribe to the Sleuthkit mailings. I didn't look past the "local host" part -
So, even if the "received from" portion of the header says "from local host 127.0.0.1"
this by itself doesn't indicate mal/spy ware? I'd just never seen that before, and just assumed it had to be incorrect.
I'm paranoid now because of all the forged emails I've had in the past with trojans in them.