the FROM: field is just a line of txt and does not
accuratly indicate the source of the message. it is common to see this
spoofed, infact i use some c# apps internally that force the from
address to something other than the users for sorting purposes.
its common, its a nusance, its SPAM. the only thing you can really do is change the users's e-mail addy to something else.