I just checked the last six months of my most diverse corpus, and found: two Ham, zero spam.
Both ham were sent via different ESPs, each of mediocre quality though with multiple legitimate (albeit Pakled-y) customers. One was from "Marriott Rewards" with terse SA report: score=0.9 required=5.1 tests=DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FH_RANDOM_SURE, FROM_EXCESS_BASE64, HTML_IMAGE_RATIO_08, HTML_MESSAGE, URIBL_BLOCKED One was from "MapMyRun" with terse SA report: score=6.3 required=5.1 tests=DIET_1, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FH_RANDOM_SURE, HTML_MESSAGE, MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI, MPART_ALT_DIFF, RCVD_IN_DNSWL_NONE, SUBJECT_DIET That's using SA 3.3.2 with auto-updates (at a shared webhost). Upon request, off list I can send the Message-IDs to any SA dev(s). If the corpse(s) would be helpful, I can ask the domain admin for them. I'm planning some data-mining this weekend, and would be happy to check more data (mild brag: I finally added flagging to my data-mining tools, so it will auto-log, even if I forget to explicitly check). :) - "Chip"