That same theory was just presented to me a little while ago by some techie geeks I know who have been looking over what I received. They think it is a virus that is being sent out but the mail failure notice did not contain an attachement it was only a garbled mess that I could not make out and was limited by the return program in size, so was not complete. They also think that bounce back could have been done on purpose to try and infect me. They said if anyone put that address in their email address book it could have been taken from there. Just like you said someone sent mail to your work. Therefore, your theory and theirs of who is fraudulently using my ID would be the same, who ever made the virus. If this theory holds to be true, this may sound funny, but I could accept something like that happening by accident a lot easier than anyone using that addy on purpose. Gives me a bit of my rose colored glasses back, Thank you. :-) The unfortunate thing is that if the ISP I wrote to thinks it is a virus also they may not even bother tracing. A lot of them just say virus protection is the responsiblity of our customers not ours. Which means someone has a virus, doesn't know it and is no way of telling them. The only good news they had for me was that if it is the virus they are thinking W32.Sobig.E@mm, it has a death code and will stop being transmitted on the 14th. Again no one open anything from learningware if you receive something.