In an older episode, on 2013-06-02 16:16, David F. Skoll wrote:
3) Envelope sender is in the nacha.org domain
2 days ago, we received hundreds of mails with that envelope sender domain containing malware like
Case_05312013_28192.exe extracted from the attachment Case_3375975.zipAnd currently, hundreds of mails with said sender domain are being rejected here due to RBLs.
Regards, wolfgang