How do you guys and gals handle it? Specifically, my clients get a few and I am getting them now where the return (spoofed) email address is something like johndoe@mydomain.com. So when the email is returned, I get it. My client's email box actually fills up if she does not check her email daily and she has a 100M box.

I have SPF records, I am AOL white-listed (whatever), require SMTP verification, and I do my best to keep up with the email protocols.

Anything that you can recommend for this?