I'm working with a customer of mine who I believe has some form of malware on his machine that is rewriting the subject line for all of his outbound emails. Here are the symptoms.

1. The office has quite a few users and they all use the same SMTP server. Only one user is has this problem.
2. When the problem user composes an email with a certain subject, the recipient receives the email, but the subject is always preceded with SPAM:
3. The mail headers show that Spam Assassin looked at it, but scored it as non-spam.

Has anyone heard of or seen anything like this? Does any have any ideas how to fix it? I have included the mail headers below (with slight modifications to protect the innocent):

From - Wed Jul 2 22:31:32 2008
X-Account-Key: account5
X-UIDL: 1215019732.12766.avenger.weirdwares.com,S=3626
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
Delivered-To:
Received: (qmail 12764 invoked by uid 89); 2 Jul 2008 17:28:52 -0000
Received: by simscan 1.3.1 ppid: 12743, pid: 12744, t: 3.2986s
scanners: attach: 1.3.1 clamav: 0.92/m:45/d:5110 spam: 3.1.7
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
avenger.weirdwares.com
X-Spam-Level:
X-Spam-Status: No, score=-0.7 required=5.0 tests=AWL,BAYES_20,HTML_MESSAGE,
RDNS_NONE autolearn=no version=3.2.4
Received: from unknown (HELO problemuser.com) (127.0.0.1)
by avenger.weirdwares.com with (DHE-RSA-AES256-SHA encrypted) SMTP; 2 Jul 2008 17:28:48 -0000
Received-SPF: pass (avenger.weirdwares.com: SPF record at problemuser.com designates 127.0.0.1 as permitted sender)
Received: from ADPFINANCE ([127.0.0.1])
by lasvegasferrari.com (8.12.11/8.12.11) with ESMTP id m62HSlM9017683
for ; Wed, 2 Jul 2008 12:28:48 -0500
Reply-To:
From: "Problem User"
To: "'Support User'"
Subject: SPAM: Website
Date: Wed, 2 Jul 2008 11:24:25 -0600
Message-ID: 049d01c8dc68$7a103090$0490a8c0@ADPFINANCE
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_049E_01C8DC36.2F75C090"
X-Mailer: Microsoft Office Outlook 11
thread-index: AcjcaHl8gIrxSrn5TmqGq4RNiT0f5g==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198

This is a multi-part message in MIME format.

------=_NextPart_000_049E_01C8DC36.2F75C090
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit