The company claims to have no knowledge of who is sending out the ads they disclaim responsibility for. Looking at the Received Headers gives a good idea of where they are coming from (especially if the injection point is their SMTP Server). They should be looking at the injection points if they claim the ads are not theirs instead of just being willing to benefit from the ads. IMO, so long as you benefit from the ad, you are responsible for it (even if someone else sent it, with or without your permission or request) unless you make an effort to track down unauthorized ads sent in your name or for your benefit.