Most likely, the sender is just spoofing the client's email address as the "from" address. It's easily done. It happens to us all the time. Our email addresses are taken off our website by spammers. You can look at the email header and see what IP address it's coming from - it's not ours. I've been told by people I respect in this area that there's really nothing I can do - just use a spam filter, and ignore it. If the spam from a particular IP address gets bad, you can block that I think. I've had tech support with our web host help set that up on our server.