Have you tried spoofing the envelope address or reply to address, but have the header address as one you control?