We're seeing FPs Twitter's "So-and-so is now following you on Twitter"
notices, pushed over by JM_SOUGHT_3's 4 points. It appears to be
matching on __SEEK_O1OO80, which contains a large chunk of Twitter's
email footer.
If I were to guess, it's probably due to the phishing campaign that's
been targeting Twitter users over the last few weeks, faking a message
from Twitter support. I've seen several of those phish land in our own
spamtraps and abuse mailbox.
I can send a ham sample if that would help.
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
