Customer addresses harvested and blasted by spammer

This is NOT the typical "support@ spam opens a new case": this is specific to one customer only.

One of our customers was infected by a spam trojan. Apparently the trojan gathered addresses from their Outlook address book and history--including the various case* and messages* aliases NetSuite uses to log emails to the appropriate case/customer record.

The spammer has been using the harvested addresses: this is causing cases to be re-opened (some as old as two years!) and various messages to be logged under the Communications tab of the customer's record.

NetSuite trims off the SMTP headers of the incoming messages, so there's no way for me to analyze the headers and block via blacklists; they all appear to be coming from NetSuite itself. And needless to say, we don't block anything from NetSuite's mail servers.