Hi I add almost full header of these 3 message, if it helps to explain. All samples had a subject Spam added and my OL was the receipent.
Return-Path: <........@xxxx.ee> Received: from MXR-12.estpak.ee ([88.196.174.176]) by mbox1-1 (Cyrus v2.3.13) with LMTPA; Tue, 20 Jan 2009 21:29:17 +0000 X-Sieve: CMU Sieve 2.3 Received: from localhost (localhost [127.0.0.1]) by MXR-12.estpak.ee (Postfix) with ESMTP id 3836E4413 for <.....@online.ee>; Tue, 20 Jan 2009 23:29:11 +0200 (EET) X-Virus-Scanned: amavisd-new at estpak.ee X-Spam-Flag: YES X-Spam-Score: 5.831 X-Spam-Level: ***** X-Spam-Status: Yes, score=5.831 tagged_above=1 required=4.91 tests=[BAYES_00=-1, DOS_OE_TO_MX_IMAGE=3, DYN_RDNS_AND_INLINE_IMAGE=0.001, DYN_RDNS_SHORT_HELO_HTML=0.499, DYN_RDNS_SHORT_HELO_IMAGE=0.001, EXTRA_MPART_TYPE=1, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_DYNAMIC=0.1, SHORT_HELO_AND_INLINE_IMAGE=0.781, TVD_FW_GRAPHIC_NAME_MID=0.543] Received: from MXR-12.estpak.ee ([127.0.0.1]) by localhost (MXR-2.estpak.ee [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pQ0yWqGnxFGZ for <......@online.ee>; Tue, 20 Jan 2009 23:29:06 +0200 (EET) Received: from Relayhost2.neti.ee (relayhost2.neti.ee [88.196.174.142]) by MXR-12.estpak.ee (Postfix) with ESMTP id E804D5D42 for <......@online.ee>; Tue, 20 Jan 2009 23:29:06 +0200 (EET) X-SMTP-Auth-NETI-Businesmail: no Received: from ...mada30 (xx.175.190.90.dyn.estpak.ee [xx.190.175.78]) by Relayhost2.neti.ee (Postfix) with SMTP id CE2621F9E65 for <.....@online.ee>; Tue, 20 Jan 2009 23:29:07 +0200 (EET) Message-ID: <115a01c97b46$1617de80$7901a...@mada30> From: "........" <........@xxxxx.ee> To: "RA" <......@online.ee> Subject: ***SPAM*** =?iso-8859-1?Q?m=E4lupulgad?= Date: Tue, 20 Jan 2009 23:28:50 +0200 Organization: Law Offices MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_1156_01C97B56.D9790240"; type="multipart/alternative" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2962 -------------------------- Return-Path: <....@la.tln.edu.ee> Received: from MXR-2.estpak.ee (relay2.neti.ee [88.196.174.133]) by mbox2-1 (Cyrus v2.2.13-Debian-2.2.13-10) with LMTPA; Thu, 30 Oct 2008 19:08:14 +0200 X-Sieve: CMU Sieve 2.2 Received: from localhost (localhost [127.0.0.1]) by MXR-2.estpak.ee (Postfix) with ESMTP id E55736146A2 for <......@online.ee>; Thu, 30 Oct 2008 19:08:13 +0200 (EET) X-Virus-Scanned: amavisd-new at estpak.ee X-Spam-Flag: YES X-Spam-Score: 6.002 X-Spam-Level: ****** X-Spam-Status: Yes, score=6.002 tagged_above=1 required=4.91 tests=[BAYES_00=-1, DOS_OE_TO_MX=2.75, DYN_RDNS_SHORT_HELO_HTML=0.499, HTML_MESSAGE=0.001, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1] Received: from MXR-2.estpak.ee ([127.0.0.1]) by localhost (MXR-2.estpak.ee [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mHS41u6Dm1OE for <.....@online.ee>; Thu, 30 Oct 2008 19:08:09 +0200 (EET) X-SMTP-Auth-NETI-Businesmail: no Received: from yourahean8fxsm (xxx-250-188-1-tln.edu.estpak.ee [195.250.188.1]) by Relayhost3.neti.ee (Postfix) with SMTP id EED7FD4CC0 for <.....@online.ee>; Thu, 30 Oct 2008 19:08:08 +0200 (EET) Message-ID: <80b98cd35e274c6e99d374d9bdc6a...@yourahean8fxsm> From: "Mari" <......@la.tln.edu.ee> To: "RA" <.....@online.ee> Subject: ***SPAM*** Lasteaed Date: Thu, 30 Oct 2008 19:08:19 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00B7_01C93AC2.DEDB4BF0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5512 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 ------------------------ Return-Path: <and...@xxxx.eu> Received: from MXR-3.estpak.ee (relay3.neti.ee [88.196.174.134]) by mbox2-1 (Cyrus v2.2.13-Debian-2.2.13-10) with LMTPA; Tue, 23 Sep 2008 00:36:56 +0300 X-Sieve: CMU Sieve 2.2 Received: from localhost (localhost [127.0.0.1]) by MXR-3.estpak.ee (Postfix) with ESMTP id 97E614A2192 for <.....@online.ee>; Tue, 23 Sep 2008 00:36:54 +0300 (EEST) X-Virus-Scanned: amavisd-new at estpak.ee X-Spam-Score: 1.047 X-Spam-Level: * X-Spam-Status: No, score=1.047 tagged_above=1 required=4.91 tests=[BAYES_00=-1, HTML_MESSAGE=0.001, RCVD_IN_SORBS_DUL=2.046] Received: from MXR-3.estpak.ee ([127.0.0.1]) by localhost (MXR-3.estpak.ee [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M6mUOo-prnMu for <.....@online.ee>; Tue, 23 Sep 2008 00:36:47 +0300 (EEST) Received: from inte555 (xxx-35-171-67-dsl.trt.estpak.ee [213.35.171.67]) by Relayhost1.neti.ee (Postfix) with SMTP id 53F0A1EAA5C for <.....@online.ee>; Tue, 23 Sep 2008 00:36:51 +0300 (EEST) Message-ID: <00a901c91cfb$5154a2c0$0702a...@intel...> From: "Andres" <and...@xxxxx.eu> To: "RA" <.....@online.ee> References: <20080922190750.5b575d3...@relayhost3.neti.ee> Subject: Re: ***SPAM*** Date: Tue, 23 Sep 2008 00:36:47 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00A6_01C91D14.766AEC40" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 -- View this message in context: http://www.nabble.com/Wwird-flagging-of-emails-to-Spam-tp21574031p21575209.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.