the problem with the sender's address is "which one?". I looked for the "reply to" in the header and even that was not an e-bay/paypal address. I did think of replying with spoof data but by not replying to any spam/scam - they don't know if it is a lurker watching for such or not. It only needs a few out of the millions they try, to monitor their activity. The ISP's must have a few each.