Are they really spoofed, other than the eku? Mine appear to come from a legitimate source but when I look at the headers, they are actually coming from the long, weird domain names I spoke of.