Got what looks like a false positive on this high-scoring rule (under 2.63). It is a personal email, a reply to a previous message, sent by an MSN subscriber using MSN software. Here's the header, with only recipient info and sender name altered:
I tested those headers on my system (2.64) and did not get a match, however, that rule doesn't seem to have changed from 2.63 to 2.64.
My suspicion is that your MDA or MUA modified the From: header when it delivered. Notice that FROM_NO_LOWER got matched, but clearly the email address has plenty of lower-case letters in it.
I'm wondering if the original From: line did not contain an email address at all, but that was added from the envelope upon delivery since it was absent.
Thus:
From: LUCINDA THOMASON
Becomes:
From: "LUCINDA THOMASON" <[EMAIL PROTECTED]>