sendmail log question

Found some odd log file entries while combating SOBIG.e

This first entry shows one instance of receiving the virus.  It has
both sendmail accepting the message and sendmail delivering the message.
I also pasted the header of the message. Pretty normal.

---

Jun 25 18:05:42 mail sendmail[4918]: h5PM5dC04918: from=<[email protected]>,
size=111813, class=0, nrcpts=1, msgid=<[email protected]>,
proto=ESMTP, daemon=MTA, relay=hv.domain.com [10.10.50.25]

Jun 25 18:05:42 mail sendmail[4942]: h5PM5dC04918: to=<[email protected]>,
delay=00:00:03, xdelay=00:00:00, mailer=local, pri=141498, dsn=2.0.0, stat=Sent

Return-Path: <[email protected]>
Received: from 94X8JT (hv.domain.com [10.10.50.25])
        by mail.domain.com (8.11.6/8.11.6) with ESMTP id h5PM5dC04918
        for <[email protected]>; Wed, 25 Jun 2003 18:05:39 -0400
Message-Id: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: Re: Movie
Date: Wed, 25 Jun 2003 17:05:34 --0500
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="CSmtpMsgPart123X456_000_018486FB"

-------

These entries do not have a log file entry for sendmail accepting the
message for delivery.  Only sendmail delivering the message.  I included
1 header

-------
Jun 25 17:18:05 mail sendmail[2397]: h5PLI2C02352:
to=<[email protected]>, delay=00:00:03, xdelay=00:00:01, mailer=local,
pri=141498, dsn=2.0.0, stat=Sent

Jun 25 16:51:54 mail sendmail[15546]: h5PKpoC15537:
to=<[email protected]>, delay=00:00:04, xdelay=00:00:01, mailer=local,
pri=141498, dsn=2.0.0, stat=Sent

Return-Path: <[email protected]>
Received: from MNELSON_LT (hv.domain.com [10.10.50.25])
        by mail.domain.com (8.11.6/8.11.6) with ESMTP id h5PKpoC15537
        for <[email protected]>; Wed, 25 Jun 2003 16:51:50 -0400
Message-Id: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: Re: Movie
Date: Wed, 25 Jun 2003 16:51:50 --0400
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="CSmtpMsgPart123X456_000_009B6ABD"

Jun 25 16:44:30 mail sendmail[9640]: h5PKiOC09573:
to=<[email protected]>, delay=00:00:04, xdelay=00:00:02, mailer=local,
pri=141498, dsn=2.0.0, stat=Sent

I tried grep the log file for the smtp id's in all instances.  I sent
mail from yahoo, my client, pine on the mail server and a machine that
lived on the same subnet.  All have two entries in the log file.  Has
anyone else seen the single entry in their logs?  I also grep'ed -20 and
looked at the lines nearby.  The 10.10.50.25 is the firewall and shows
if nothing else they came from the outside.

Thanks,
Gordon Bowersox