I'm not sure this will help or not. Anyway, here is the header I get from that annoying message. Certain server names/e-mail addresses have been changed. The stuff at the bottom 'SPAM: ....' is just our anti-spam program assigning scores to what it finds. The mail server in our case is Novell Groupwise.
Maybe this will help someone ... Mike Received: from <our mail server> by <our mail server>; Thu, 07 Aug 2003 09:00:37 -0600 Received: from guinness.omniscient.com (guinness.omniscient.com [64.134.101.78]) by <our mail server> (8.9.1-p2/8.9.0.Beta5) with ESMTP id JAA24028 for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 09:00:35 -0600 Received: from guinness.omniscient.com (localhost [127.0.0.1]) by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id h77F0ZMt023392 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO); Thu, 7 Aug 2003 11:00:35 -0400 (EDT) Received: from localhost ([EMAIL PROTECTED]) by guinness.omniscient.com (8.12.9/8.12.9/Submit) with SMTP id h77F0XVA023391; Thu, 7 Aug 2003 11:00:33 -0400 (EDT) Received: by guinness.omniscient.com (bulk_mailer v1.13); Thu, 7 Aug 2003 11:00:33 -0400 Received: from guinness.omniscient.com (localhost [127.0.0.1]) by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id h77F0WMt023386 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 11:00:32 -0400 (EDT) Received: (from [EMAIL PROTECTED]) by guinness.omniscient.com (8.12.9/8.12.9/Submit) id h77F0WIh023385 for amanda.org.amanda-users-list; Thu, 7 Aug 2003 11:00:32 -0400 (EDT) X-Authentication-Warning: guinness.omniscient.com: majordom set sender to [EMAIL PROTECTED] using -f Received: from sapphire.omniscient.com (sapphire.omniscient.com [64.134.101.71]) by guinness.omniscient.com (8.12.9/8.12.9) with ESMTP id h77F0TMt023381 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 11:00:30 -0400 (EDT) Received: from localhost (pool-138-89-183-57.mad.east.verizon.net [138.89.183.57]) by sapphire.omniscient.com (8.12.9/8.12.9) with SMTP id h77Exwem003144 for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 11:00:11 -0400 (EDT) Date: Thu, 7 Aug 2003 10:59:58 -0400 (EDT) Message-Id: <[EMAIL PROTECTED]> From: [EMAIL PROTECTED] To: Amanda-users <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] X-Mailer: The Bat! (v1.61) X-Priority: 2 (High) Subject:S-P-A-M 8.1/5.0 your account roowuomj MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------E4D3400C0061DF1" Sender: [EMAIL PROTECTED] X-Spam-Flag: YES X-Spam-Status: Yes, hits=8.1 required=5.0 tests=SUBJ_HAS_UNIQ_ID,FORGED_MUA_THEBAT,NO_REAL_NAME, SUBJ_HAS_SPACES,X_AUTH_WARNING X-Spam-Checker-Version:GEE Whiz GAS (Gee Anti Spam) v1.3.1 X-Spam-Level: ********* ------------E4D3400C0061DF1 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hello there, I would like to inform you about important information regarding your email address. This email address will be expiring. Please read attachment for details. --- Best regards, Administrator rooruomu ------------E4D3400C0061DF1 Content-Type: application/x-zip-compressed; name="message.zip" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="message.zip" Click to view Base64 Encoded File message.zip Content-Type: text/plain; name="gas-results.txt" Content-Transfer-Encoding: attachment; filename="gas-results.txt" Content-Disposition: 7bit SPAM: SUBJ_HAS_UNIQ_ID (1.5 points) Subject contains a unique ID SPAM: FORGED_MUA_THEBAT (4.3 points) Forged mail pretending to be from The Bat! SPAM: NO_REAL_NAME (0.9 points) From: does not include a real name SPAM: SUBJ_HAS_SPACES (2.4 points) Subject contains lots of white space SPAM: X_AUTH_WARNING (-1.0 points) Has a X-Authentication-Warning header Score Total: 8.1