Hi, I'm guessing that TO_IN_SUBJ only pops when the Subject: contains the full email address in To:, not just the user part... is that right? I've been getting a bunch of spam (some of which ends up as FNs) with just the username portion of To: in the Subject line. This is almost invariably spam, so I think it might be worthwhile to add a TO_USER_IN_SUBJ which focuses only on the user part. Presumably one might want to score this a tad lower than TO_IN_SUBJ, but maybe not...
A spample is here: http://pastebin.com/qNu0TsfF John, thoughts? Thanks. --- Amir