I ran into the same problem recently. The bitch about "This message could not be delivered messages" is that the headers will only be for the return from the bounce. The only time you'll have the original headers of the message included before the bounce, is if it bounced off a particular configuration of qmail that supplies them, but it'll be in the message body.
In other words, about 1 out of 500 emails will have something that
might could lead back to where it originated. However, even then, they're most likely going through an open mail relay (considered user friendly early on in the game, but now seen as a serious risk becuse of recent abuse) and, well, "goodluck!" in tracing it back.
One of these programs walks randomly through user names of a given domain to fill in bogus ReplyTo, From and EnvelopeFrom fields. When that happens, you'll get all the bounce backs from non-existent e-mail accounts on their lists,
BUT only if you have your mail forwarding on your server set as "@yourdomain.com". What's needed is to immediately change that setting to a list of the specific e-mail accounts that you actually need, such as "
[email protected],
[email protected],su
[email protected]" and include any other user name accounts you have listed on your site for contact. Send the rest to the bit bucket!