MS SA autolearn oddness

[Michele Neylon :: Blacknight Solutions]

I've noticed a couple of worrying entries in our mail logs on one server and
was wondering if anybody else had any ideas.

I have *not* set SA to "learn", although I experimented with that setting a
couple of weeks ago. However, I am still seeing:

Feb 19 00:16:53 camelot MailScanner[28987]: Message i1J0GhYG029364 from
64.70.43.5 (adv at sheck-buy.com) to somedomain.com is spam, spamh
aus-xbl-sbl, spamcop.net, SpamAssassin (score=23.959, required 8.5,
autolearn=spam, ADVERT_CODE 1.82, BAYES_99 5.40, DCC_CHECK 2.91, EMAIL_RO
T13 4.10, HTML_70_80 0.10, HTML_FONT_BIG 0.27, HTML_IMAGE_ONLY_04 1.00,
HTML_MESSAGE 0.10, HTML_MIME_NO_HTML_TAG 1.18, MAILTO_SUBJ_REMOVE 0.8
9, MIME_HTML_NO_CHARSET 0.56, MIME_HTML_ONLY 0.32, OBSCURED_EMAIL 2.70,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_SBL 1.11)

This is a little worrying, as we have had to disable spamcop on one server
due to an increasing number of false positives (which I cannot explain
either - but that's another issue)

Does anybody have any Perls of wisdom?  (excuse the pun :)  )

Michele

Mr. Michele Neylon
Blacknight Internet Solutions Ltd
http://www.blacknightsolutions.ie/
http://www.search.ie/
Tel. + 353 (0)59 9137101
Lowest price domains in Ireland