email scam outlook

[#1]

Hi
I'm running XP with Outlook. I replied to an email from a friend and after I'd sent it noticed in my sent-items folder that it had not been sent to his address. Rather it had been sent to sgtcharlessh@outlook.com
A quick google of this address shows that addresses similar to this are used by scammers.
I prepared a new reply to my friend and sure enough it too was addressed with the same "send to" address so of course I didn't send it this time.
I checked for this behavior by preparing a reply to several other emails in my inbox and they were all fine in as much as the replies were addressed correctly.
So my question is: Is it MY copy of outlook that has been compromised or HIS email client?
Just to be clear, HIS email is the only one that when I prepare a reply to it, it has this false return address.
Thanks for any insight.

[#2]

Have you asked him, or taken a look at the headers on the e-mail you are trying to reply to?
It sounds like the e-mail you are replying to has got a Reply-to header line set. That may be deliberate on his part, if he is trying to manage e-mail using Outlook.com, or his mail client may have been compromised by someone trying to intercept his e-mails.
Send him an e-mail by typing in his address rather than hitting Reply. If that gets altered then your client has a problem. If not use the e-mail to ask/warn him.

[#3]

Thanks for your help.

Quote from: wisty

Have you asked him

I wanted to check here first before doing anything.

Quote from: wisty

or taken a look at the headers on the e-mail you are trying to reply to?

Just looked now.

Quote from: wisty

It sounds like the e-mail you are replying to has got a Reply-to header line set.

You are correct.

Quote from: wisty

That may be deliberate on his part, if he is trying to manage e-mail using Outlook.com, or his mail client may have been compromised by someone trying to intercept his e-mails. Send him an e-mail by typing in his address rather than hitting Reply. If that gets altered then your client has a problem. If not use the e-mail to ask/warn him.

I've just sent him a test email with his address hand typed and it goes to him as addressed.
I guess it looks like his system has been compromised but then again I suppose I have too as my address will now be in "their" hands.