Yup, I understand how the whole AWL works but my problem is that border line spam is being dropped to ham. Example: A normal markup of 5.6 and an AWL score of -0.8 drops it below the average user required_hits of 5 and does not get marked as spam.
Right, but it's an averaging system, so if you're seeing negative AWL scores, that means that future mails from the same sender will be averaged higher, eventually auto-blacklisting that address.
I think a longer example would make it clearer. Let's say the first message from that sender scored 4.8, and the second and third messages scored 5.6, and so on. Let's see what happens:
Message 1: 4.8 (first message from this sender & IP, no AWL hit) Message 2: 5.6 AWL:-.8 final score: 4.8 Message 3: 5.6 AWL:-.4 final score: 5.2 Message 4: 5.6 AWL:-.27 final score: 5.33 Message 5: 9.8 AWL:-4.6 final score: 5.4 Message 6: 3.5 AWL:+4.35 final score: 7.85 Message 7: 4.8 AWL:+2.18 final score: 6.98 Message 8: 3.5 AWL:+2.17 final score: 5.67 Message 9: 15.5 AWL:-10.1 final score: 5.4 Message 10: 3.5 AWL:+3.02 final score: 6.52
Note how every time you see a large negative number in the AWL score, the very next message has a significantly higher final score. The AWL always sets the message's final score to exactly match the average score of all the messages received from that sender in the past. Note how message #8 originally scored 3.5, but AWL gives it +2.17, while message #10 (also originally 3.5) gets an AWL adjustment of +3.02 because of the high score message #9 received.
This is great for reducing false positives from a person you correspond with often, who sends you something spammy-looking once in a while. Also note how the resulting final scores are much less erratic than they would be without AWL. In this example, we would have half the messages scoring below the spam threshold without AWL, but with AWL enabled, only the first one gets through.
SA developers: feel free to add this example to the wiki if you think it would be helpful.
