The warning is for 'recipients' from that 'authenticated user' the log is showing you the 'return path'. A spammer in particular will not use the return path of the authenticated user...

Search for the user
brHIDDEN@@hrc.com.auAnd see if that shows up anything else. It should be recorded in the 'Received:'.. log entries

      ChrisP.