I haven't experienced it but I had seen elsewhere as your #2 point: spoofs getting bounced back. They usually die down after a short while since the spammer does one big run per spoofed email address.

If it continues then I'm not sure what it could be. Turning off Mailwasher for a test period is certainly something I would do. Doesn't your ISP have a good spam filtering software at the server level?