change "from:" to "from: " in getfrom()

Again, it triggered on the wrong from:
It triggered on signed e-mails which uses metadata:

h=mime-version:x-received:date:message-id:subject:from:to:content-type;

in the header, solved by adding a space (which is still well within standard mail protocol)