Something I did notice though was that a few kb email received a huge 38pts. Now, I didn't do any time tests on that email to check how long it actually took to process, but I'm assuming longer than one that only scored a little over 5pts.
That's not a very valid assumption.
All the rules get run regardless of how many hit, and that's what takes time...
Yeah, you probably added a few hundred CPU clocks to the report generation, but that's fractions of a microsecond.
I am wondering if it would be possible for a spammer / dos virus to flood a smtp server with a email that was crafted in such a way that it would score as high as possible and or find tests that take longer than others while maintaining a very small file size. I'm imagining that, enough email would make a server crawl and start causing smtp timeout problems.
No.. processing time is a mostly a function of the time it takes to run the rules, not the number of matches.
You can probably craft an email to force the slowest path possible through the ruleset regexes, but this won't be a significant add to the processing time.
