Block email when two fields are equal to each other

Fathi

Renowned Member
May 13, 2016
141
9
83
53
Tunis, Tunisia
Hi,
Some people are sending spam to my users from their own emails: Spam appears to be sent from the receiver address. This causes some panic as people think their accounts have been hijacked.
How could i block email when the sender=the receiver (From=To). I have rules taht match field to a static value or to a regular expression, but how to match to fields.
I already tried to block outside email sent from internal addresses, as smtp ports are open only on internal network, but this doesn't seem to stop identity thieves.
TIA
 
Please post the logs of such a mail - maybe there is a spamassassin hit which is fitting for this)