I'm running Debian, sendmail, spamass-milter, spamc and spamd. I saw this in my log:
Jun 9 20:30:29 debian sm-mta[15942]: t5A0ULAA015942: to=<--u...@example.com > then I saw this: Jun 9 20:30:29 strange spamc[15947]: invalid usage Jun 9 20:30:29 strange spamass-milter[1770]: Thrown error: poll says my write pipe is busted That seems pretty scary that someone can send to a user which begins with -- and fake out spamc that it's a command line option.