false positive?

[Tim Tyler]

mailscanner experts,
   We are running 4.x version of mailscanner with spamassassin which we
updated last month.  We have been running it for nearly  3 weeks now and I
got my first report of a false positive.  A professor received a legitimate
message with a score of 6.4.  The relevant headers are below:

 >> X-MailScanner: Found to be clean
 >> X-MailScanner-SpamCheck: spam, SpamAssassin (score=6.4, required 5,
 >>     MIME_BOUND_NEXTPART 0.16, RCVD_FAKE_HELO_DOTCOM 3.43,
 >>     RCVD_FAKE_HELO_DOTCOM_2 2.80)
 >> X-MailScanner-SpamScore: ssssss

The bulk of the score relates to rcvd_fake_helo_dotcom.   Can anyone tell
me what that means and why it might occur on a legitimate message?  I
believe the message was sent from a service in Morocco for whatever that is
worth.


Tim Tyler
Network Engineer - Beloit College
tyler at beloit.edu