The warning is for 'recipients' from that 'authenticated user' the log 
is showing you the 'return path'.  A spammer in particular will not use 
the return path of the authenticated user...

Search for the user

HIDDEN@hrc.com.au

And see if that shows up anything else.  It should be recorded in the 
'Received:'.. log entries

     ChrisP.