2. How does mail get from spamd to the users?
When the check has been finished, mail is delivered by exim to an
appropriate user.
Hum. I don't know exim, although others here do. It sounds to me like exim
must have been modifying the SA produced markup and passing that along. You
could have gotten something like that line of +++++++++ marks using
STARS(+). But I have the impression you were upgrading from 2.6x or so, and
I don't think you could change the character from an asterisk back then
without modifying code. (I may be wrong though, its been a long time). I
also don't think you could have gotten the specific spam header you showed
without some modifications somewhere.
I would be inclined to look around the exim config and see if there is
anything there that will redo the SA markup into another form.
Loren
