Assuming you're talking about reply address masking, I can tell you this -- mail clients put return addresses in all sorts of custom header fields, and it's very difficult to weed them all out -- the way our code does it now is to hit all the standard headers that would have the protected (forwarding) address in them and replace what's there with the disposable. The code then searches the entire message for instances of the protected address, and replaces those, too. If the user's mail program is putting in a different address from the protected address in a non-standard place, it could be missed -- for instance, say I have two email addresses that go to the same place --
me@example.org, and
otherme@some.example.com. I receive mail on both addresses, but my local email program thinks my return address should be
me@example.org, and I sign up at spamgourmet using
otherme@some.example.com as my protected address. When I reply using reply address masking, spamgourmet will hit all the standard headers and replace what's there, and it'll also look for instances of
otherme@some.example.com, because that's the protected address for the account, but it may miss instances of
me@example.org if they're in non-standard places.