Wow... good question.
Spy++ does not appear to record the source process or thread, nor is that available with a message hook.
Any process can send any message to any window and remain anonymous while doing so. Until recently, that's been a security issue with System Services that expose a U/I -- some outside program could pull the strings of the Service, and thus obtain elevated privileges.
However, If I were you, I'd not suspect outside programs until I'd ruled out my own program and even controls (such as RichEdit) that are outside of your direct control. WM_USER+100 is a common value -- its usually safe to assume that a standard window (such as a button control) will ignore it.
However, I know that MFC uses, for instance, WM_USER+101 in its CMFCPropertyGridCtrl intenal handling, so I can't rule out +100 (though I can't find it in the MFC source files).
You might be able to get a clue by looking at the lParam and wParam.