Forwarded spam - a new headache

[dwmtractor]

Clear as a bell, Rich. Thanks for taking the time for such a detailed reply, it makes sense out of quite a bit of odd behavior I've seen.

I'm afraid evaluating the "From" line as a spam/ham token, apart from being redundant given other white/blacklisting options, is also a gift-wrap to the spambot community that they have (fortunately) yet to unwrap, but that is a subject for SpamAssassin's boards, not this one.

I'll run a few tests though and see what comes to the surface.

Dan