Taking into account all the replies that I've seen so far, I would modify my
proposed amendment to RFC 2821 as follows:
An SMTP server MAY decline to send the "undeliverable mail" notification
message when it can be reliably determined that the original message had
malicious or deceitful intent. Determination of such intent is beyond the
scope of this specification. However, SMTP servers MUST NOT decline to send
a notification when the only evidence of deceit is an apparently spoofed
originator address.
Daryl Odnert
Tumbleweed Communications
daryl(_dot_)odnert(_at_)tumbleweed(_dot_)com