I followed my own advice about egrep -R and found this immediately it's in
3.004006/updates_spamassassin_org/72_active.cf
and it is
##{ FSL_HELO_NON_FQDN_1
header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+
helo=[a-zA-Z0-9-_]+ /i
##} FSL_HELO_NON_FQDN_1
with score
score FSL_HELO_NON_FQDN_1 2.361 0.001 1.783 0.001
signature.asc
Description: PGP signature
