No no, not an arbitrary From: field. I'm assuming that he's trying to do a single email form for multiple sites or domains. He could check the REFERER to make sure its an allowed domain and then send an email with the from field being an address at that domain. So if foo.com is allowed to send mail through his form and a request comes from foo.com he sends the email with the From field with someone@foo.com where someone@foo.com is a real person expecting a reply perhaps.

That would work for most cases and where a client isn't sending the REFERER or its wrong then the connection is dropped, eleminates spammers. Maybe I should have been more clear.

On another note, companies that are hosting multiple websites do this sort of thing all the time (I know mine does) do you consider it to be SPAM? Even if the email goes to a real person and the person receiving the email knows they are getting it?