edzillion: I know this post is quite old, but just so you know, the spammer most likely forged its reply address using an email address from your domain. Spammers forge reply addresses of legitimate email addresses all the time. Usually they move on to others and you have to wait it out. Hopefully by now you no longer have this issue. Though I do not know if they are targeting an actual email address of yours or sending to a "dummy" email address at your domain: one thing that might help is if you disable your catch all and send the email sent to non-existing accounts to dev/null.

edzillion: Another thing now is spam has moved to botnets, so spam is being sent from so many originating IPs that blocklisting them all is nearly impossible, so this is why mailservers will accept some mail from seemingly spammy ISPs. Sometimes there are blacklists (BLs) that get too blacklist happy and end up blocking huge portions of the Internet, say blocking a /24 over a few spam complaints. A /24 range of IP addresses is 256, so innocent users are in that block. Sometimes it has to be done so that an ISP will even notice, so you always have two sides of the story in minimizing spam. When it gets that unreasonable, mail admins move onto other blacklists to use. Yes, some ISPs definitely do not take care of their spamming issues enough, while others are more responsible. Some BLs I recommend are Spamhaus and CBL.

Spam is considered illegal in many countries around the world, however, catching and prosecuting spammers is extremely difficult, especially since some spammers hide in countries that have government officials who choose not to cooperate with international organizations such as Interpol. Better coordination is taking place, but it is very difficult to prosecute say a Latvian-based spam group that spams shucking pharma from botnets in Brazil to recipients in France.