Trying to block System Admin undeliverables

[MJB1975]

We are using Office XP, with an Exchange Server. I would
like to block or redirect emails that are sent
from "System Administrator". An email generated from a
spam engine or virus is sending emails as if originating
from "Jane's" account to "Jill". "Jill's" account no
longer exists so it gets returned to "Jane".

I tried to make a rule on "Jane's" account to redirect any
emails [from the System Administrator] that
contain "Jill's" address in the message body. This
doesn't work, possibly because this message from Sys Admin
isn't using what is normally considered the body?? I
obviously don't want to block all these messages from Sys
Admin, but just this one scenario.

Does anyone know if this is possible?

 

[MJB1975]

I achieved the result I was looking for by making a rule
looking into the message header. For some reason that
worked, but looking into the message body does not, on
these messages from Sys Admin.