The messages that trigger these failures are generated by spam-send programs, which generate from addresses, which sometimes are the addresses of our customers. The source machines are usually on dialup / dynamic Broadband and it's relatively easy for a responsible ISP to refuse them before they get into the email system. For instance while writing this note OA5 blocked SPAM attempts --- the sending system connected, but did not log in to send mail (as you our customers do)

Sep-29-06 14:01:22 201.40.0.122 BL <archimedesbethel@royalcaribbeanonline.c >| unchecked (RBL Dropped)
Sep-29-06 14:01:23 24.170.25.246 BL <gthpofth@rr.com> >| unchecked (RBL Dropped)
Sep-29-06 14:01:24 201.40.0.122 BL <arabychesterton@roulette.org> >| unchecked (RBL Dropped)
Sep-29-06 14:01:36 204.11.103.232 BL <zoe@stilodoroto.com> >| unchecked (RBL Dropped)
Sep-29-06 14:01:39 66.218.17.140 BL <darling2plc@earthlink.net> >| unchecked (RBL Dropped)

This sort of block deals with a lot of SPAM. The next thing is checking what machine is sending the mail. We use a system called SPF to publish which machines are places where your (the sender's) domain will send mail from. When mail comes from somewhere else then it should be refused. Again from our logs:
Sep-29-06 14:03:08 212.159.14.132 SPF <AlertsBR@xxxxxxxxx.Org> >| AlertsBR@xxxxxxxxx.Org (SPF Dropped)

The limit is with the thousands of other systems out there, most of which don't make these checks, and return error messages to the purported sender (you)