looks like new spam tactic is to just have a base64 encoded png as the body of the message. oh, and use one of my domains in the reply-to.