Hi Alan,
The internet email protocol has a fundamental security design flaw. For example, someone could easily find out my website name (which is modulus.com.au) and then send a spam email purporting to come from, e.g.
fubar@modulus.com.au, with the reply address as also
fubar@modulus.com.au (the apmmers don't want to receive replies for obvious reasons). The body of the emial might have a virus attachment or might be an ad. for pills to upsize your love cannon, with another website address. As the spammers send to millions of email addresses, a portion will get replies (as you're getting). This process is known as "email spoofing". If I do not have the address
fubar@modulus.com.au set up, I will never know this is happening*. If, however, I have a "catch-all" email handler which sends all email received to modulus.com.au to my real email address, I will get flooded.
There is, AFAIK, no way to prevent email spoofing due to the protocol design flaw. All you can do is to ensure that your email set up does NOT have catch-all handling of email, so you don't get them. Of course, if they send the spam purporting to come from "
peter.hill@modulus.com.au" (my real email address), I'll still get them, but this is rarer.
* Although you don't know it's happening, your email address can end up black-banned as being mistaken for a spammer.
I hope this helps; in compensation can you paint my truck for free?
hth