find out if your ISP has an abuse department and forward that to them. If they are spoofing the email address, the message rule isn't going to help much