Nahezu zeitgleich gleich zweimal aufgeschlagen. Merkwürdigerweise ging es einmal gleich in den SPAM-Filter, das andere Mal nicht ... 
Die beiden Header:
header:
01:
02: Received: from [62.149.36.44] (helo=server16.dedicateduk.com)
03: by mx44.web.de with smtp (WEB.DE 4.110 #314)
04: ID: [ID filtered]
05: for *@*.de; Mon, 08 Mar 2010 xx:xx:xx +0100
06: Date: Mon, 8 Mar 2010 xx:xx:xx -0600 (UTC)
07: From: "order-update [at] amazon.com" <order-update [at] amazon.com>
08: To: <*@*.de>
09: Message-ID: [ID filtered]
10: Subject: {Spam?} Amazon.com - Your Cancellation (000-0000000-00000000)
11: MIME-Version: 1.0
12: Content-Type: text/html; charset=UTF-8
13: Content-Transfer-Encoding: 7bit
14: X-AMAZON-CLIENT-HOST: online-gp-19p06.iad7.amazon.com
15: bounce[BOUNCE filtered]@bounces.amazon.com
16: X-AMAZON-MAIL-RELAY-TYPE: notification
17: X-AMAZON-RTE-VERSION: 2.0
18: Return-Path: support [at] grade1.co.uk
19: X-OriginalArrivalTime: 08 Mar 2010 xx:xx:xx.0280 (UTC)
20: FILETIME=[4812DC00:01CABE7F]
header:
01: Received: from [62.149.36.44] (helo=server16.dedicateduk.com)
02: by mx39.web.de with smtp (WEB.DE 4.110 #314)
03: ID: [ID filtered]
04: for *@*.de; Mon, 08 Mar 2010 xx:xx:xx +0100
05: Date: Mon, 8 Mar 2010 xx:xx:xx -0600 (UTC)
06: From: "order-update [at] amazon.com" <order-update [at] amazon.com>
07: To: <*@*.de>
08: Message-ID: [ID filtered]
09: Subject: Amazon.com - Your Cancellation (000-0000000-0000000)
10: MIME-Version: 1.0
11: Content-Type: text/html; charset=UTF-8
12: Content-Transfer-Encoding: 7bit
13: X-AMAZON-CLIENT-HOST: online-gp-19p06.iad7.amazon.com
14: bounce[BOUNCE filtered]@bounces.amazon.com
15: X-AMAZON-MAIL-RELAY-TYPE: notification
16: X-AMAZON-RTE-VERSION: 2.0
17: Return-Path: fontenot [at] kayakers.com
18: X-OriginalArrivalTime: 08 Mar 2010 xx:xx:xx.0468 (UTC)
19: FILETIME=[482F8BC0:01CABE7F]
Der jeweils identische Text und die darin versteckte Umleitung:
Dear Customer,
Your order has been successfully canceled. For your reference, here`s a summary of your order:
You just canceled order #0000-0000000-000000
(geä.)
Status: CANCELED
_____________________________________________________________________
ORDER INFORMATION
whois:http://fmsanders.com/silhouettes.html
Sold by: Amazon.com, LLC
_____________________________________________________________________
Because you only pay for items when we ship them to you, you won`t be charged for any items that you cancel.
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
whois:http://www.amazon.com
Earth`s Biggest Selection
---------------------------------------------------------------------
Und - abweichend - in der zweiten Mail:
Lesezeichen