Can't see the difference

[Evert Ford]

the only difference i see is that the one that doesn't get blacklisted
doesn't have brackets around it
<admin at dailymail.com>
vs.
admin at dailymail.com
in your log file

I don't know if it will help, but you might try
FromOrTo:    /admin at dailymail\.com/    yes
in your blacklist rules file.

Evert Ford
Westone Laboratories

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03