Received: after From:

Era listed some of the diagnostics in his log of incoming spam, including,

|      205      X-Rejected: Received: after From:

Unfortunately, I'm getting legit mail lately with Received: after From:.
So far, however, there's never been more than one Received: line following
From:, and it has always appeared immediately after From:.