in our environment we had the same kind of issue and we run both exchange 2007 and 2003. this unusual behavior must be because of a SPYWear attach. please check the spy wears in the client PC’s. you can use the SPYBOT and it is a free tool.
Yes, this is a “spoofing” technique used by spammers. You may or may not be successful in stopping it, this is a wide-spread issue. I have seen this both on our exchange servers and in my yahoo and gmail accounts.