Also, if all your users are all on a local network (or known ip addresses) you can set up a mercS transaction filter to reject (& blacklist) MAIL FROM local users.

e.g.

 M, "*@your.domain*", BS, "554 Fraudulent MAIL FROM"

Just make sure to exempt your local ip's from the transfilter in the SMTP - Connection Control tab

I have a couple of users outside on dynamic ip's so have put exceptions for them BEFORE the reject rule

 M, "*dyn.user@your.domain*", X, "MAIL FROM accepted"

This leaves a hole in this method but these particular users don't get hit much and Spamhalter has cleaned up any that did get through like this. 

I'm using 4.51 with Spampal (spam) and AVG (virus) for about 35 users - Clients OE and Thunderbird on XP. I download all emails from the ISP to the local server. Lately, I've noticed my users emails are being spoofed. These emails are passing thru the spamfilters. I would really appreciate any suggestions on how I can resolve/fix this issue? 

Thanks in advance. 

[quote user="Cls"]

I'm using 4.51 with Spampal (spam) and AVG (virus) for about 35 users - Clients OE and Thunderbird on XP. I download all emails from the ISP to the local server. Lately, I've noticed my users emails are being spoofed. These emails are passing thru the spamfilters. I would really appreciate any suggestions on how I can resolve/fix this issue? 

Thanks in advance. 

[/quote]

Use POPFileD or Spamwall at the Mercury/32 level to catch these spams.  My POPFileD system is 99.81% effective with a FPR of less than 0.03%.  My Spamwall setup has similar effectiveness.

I'll do that. Thanks again.