One common sign of spoofed messages is mismatched message header sender (specified by the header "From") and header Reply-To. Trend Micro Email Security can detect messages with the header sender different from header Reply-To to protect you against spoofing.