An update. Turns out a setting in config.php had an IP address instead of a Domain Name. Thus the default return address with the IP was determined to be a spoof or spam by her filter.
$CFG-->wwwroot was the line. When I set up the site I even had a line commented out with the domain name. Loved that solution, cut and paste 2 slashes. Once I set myself up some test users with different email acounts, I realized what was going on. 5 minutes research sort of hinted at the config file and there was the ip address.