one of the spamming users has a forged header