>> describe TO_TOO_MANY To: too many recipients
>> header TO_TOO_MANY To =~ /(?:,[^,]{1,80}){20}/
>> score TO_TOO_MANY 0.3
>>
>> describe TO_WAY_TOO_MANY To: way too many recipients
>> header TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){30}/
>> score TO_WAY_TOO_MANY 0.3
>>
>> describe CC_TOO_MANY CC: too many recipients
>> header CC_TOO_MANY CC =~ /(?:,[^,]{1,80}){15}/
>> score CC_TOO_MANY 0.3
>>
>> You can vary the number in {} to whatever suits you.
>
> ...and the scores, of course.
Brilliant minds think alike ;-) I have very similar rules in my
khop-general channel:
header KHOP_BIG_TO_CC ToCc =~ /(?:[^,\...@]{1,6...@[^,]{4,30},){10,19}/
describe KHOP_BIG_TO_CC Sent to 10+ recipients instaed of Bcc or a list
score KHOP_BIG_TO_CC 0.3 # 20090527
header KHOP_GIANT_TO_CC ToCc =~ /(?:[^,\...@]{1,6...@[^,]{4,30},){20}/
describe KHOP_GIANT_TO_CC Sent to 20+ recipients instead of Bcc or a list
score KHOP_GIANT_TO_CC 0.7 # 20090527
