" There are patterns emerging that are making me wonder if there is an infected/effected script somewhere"

 

I think you are on to something there Natoli.

 

My guess would be that the script the harvester is using, filters specific "From" or "Subject" references included in the header, in the interest of either not being caught (Not harvesting an entire domain), or weeding out reduntant E-mail address.

 

Perhaps he/she filters only those "From" and/or "Subject *@renderosity.com lines in which he feels he'll gain the highest yield.

 

Awesome Investigating.

 

Tom

“The fact that no one understands you…Doesn’t make you an artist.”