Sadly not possible as these emails are getting rejected, we reject anything with a spam score over 10. So no I don't have the headers, but they are all happening to the same organisation and they are all lotus notes users.
When your MTA rejects the email, does it by any chance log the hits in the maillog?
Is there any way to make your integration tool do this?
If not, why are you still using the tool? :)
(slight humor intended here, but really, a decent tool should be able to detail in the log why it rejected an email. Otherwise you run into problems like this one where you have no real idea why email is being rejected.)
If you can't make your tool log, can you add a whitelist_from on a temporary basis and then get the hits from the message headers of a message that got through? (basically if you ignore the USER_IN_WHITELIST, you can look at the other rules to figure out why it's scoring so high and figure out what to do to correct it).
From the looks of the emails I have it is probably something non-lotus related, as I've got a large number of messages from lotus notes users, and the worst rule that seems to be hitting on them is NO_REAL_NAME.
Any chance that organization's mailserver is listed in some RBLs you use?
Do you use Razor 2.61 or Surbl? if so, do they have a footer with a web-link which might be listed? (Razor 2.61's e8 is url oriented like SURBL is)
Do you use any add on rulesets? (if you use sa-blacklist.cf double check to make sure they aren't in it!)
