Copy admin on phish attempt

[mcesari]

We have had a lot of phishing scam emails lately, so I was wondering if it was possible to have Zimbra send me a copy of any email that contains certain words, (Password: or Webmail, etc)

Im not sure if this could be done using postfix or spamassassin and I know how to make a spammassasin rule that would mark all messages with certain words as spam, but it would be nice if I was sent any emails that could possibly be a phish scam. This way I could create outbound filters before anyone could reply.

I think using always_bcc and then setting up filters to send myself the mail I want would be overkill.

Does anyone have any other ideas?