On Sat, 28 Apr 2012 08:12:02 +0100 corpus.defero wrote: > On Fri, 2012-04-27 at 18:41 +0100, RW wrote:
> > I think the intention is to look for spam where the headers say > > it's a reply, but it doesn't look like a reply. reply-type seems to > > be made-up by Microsoft so the rule is looking for spoofed headers. > > > > The problem is that, from a quick search though this list, > > reply-type doesn't seem to specific to replies. > > > > > It was a false positive for me too. I'm wondering if the sender used > the 'reply to' button in error, cleared the content, and then put > fresh content in? The examples I saw started new threads, rather than hijack old ones, so that doesn't seem to be neccessary.
