Has anyone noticed exploits involving the use of "X-Actual-Recipient" to covertly divert e-mail from an intended recipient to someone else? I have been told that only someone with root access on the recipient's mail service provider could insert an X-Actual-Recipient directive into the header of a message. It is not clear to me where X- directives are spun into the header information of an e-mail message. Can a sender do this kind of thing? Can the sender's ISP do this kind of thing? Or is it only on the receiving end that X- directives may be added in to the header information?