Found to be spam, but subject not modified?

[Magnusson, Andrew]

This email (headers follow) was clearly spam, and the
X-MailScanner-SpamCheck header shows it was determined to be spam by
SpamAssassin as well as a blacklist. But the subject line was never
modified. Has anyone seen this particular issue? I took a look through the
archives but came up blank.

Most spam is properly tagged with {SPAM?} in the header, but not this one,
and several others we received this morning. Any ideas?

We're running MS 4.34.8, SA 3.0.

...
Received: from OUTGOING79.postalmailhostings.com (unknown [69.1.199.80])
        by xxxx.cocc.com (Postfix) with SMTP id 3E2E47D06B6
        for <MATTHEW.RICHARD at COCC.COM>; Wed, 13 Oct 2004 00:19:46 -0400
(EDT)
Date:Wed, 13 Oct 2004 00:19:45 -0700
From: K2Smokes <sorogers at OUTGOING79.emailaccountzip.com>
To: <MATTHEW.RICHARD at COCC.COM>
Subject:$12.99 American Marlboro Cartons
X-ID:1836957
Mime-Version:1.0
Content-type: text/plain
Content-Transfer-Encoding: 7bit
Message-Id: <20041013041946.3E2E47D06B6 at xxxx.cocc.com>
X-MailScanner-cocci: Found to be clean, Found to be clean
X-MailScanner-SpamCheck-cocci: spam, SBL+XBL, SpamAssassin (score=14.289,
        required 7, autolearn=spam, BAYES_99 2.00, DNS_FROM_AHBL_RHSBL 0.29,
        HTML_50_60 0.09, HTML_FONT_BIG 0.14, HTML_FONT_SIZE_LARGE 0.15,
        HTML_MESSAGE 0.00, HTML_TEXT_AFTER_BODY 0.06,
        HTML_TEXT_AFTER_HTML 0.03, MIME_HTML_ONLY 0.18,
        MSGID_FROM_MTA_ID 1.72, RCVD_IN_SBL 0.11, RCVD_IN_SBLXBL 7.00,
        SUBJ_DOLLARS 0.05, URIBL_SBL 1.00, URIBL_WS_SURBL 1.46),
X-MailScanner-SpamScore-cocci: ssssssssssssss
X-MailScanner-Information-cocci: Please contact the ISP for more information
X-MailScanner-From: sorogers at outgoing79.emailaccountzip.com
...

Andrew Magnusson
Internet Product Analyst
COCC
1-877-678-0444 extension 640



--
*** This message originates from COCC, Inc.

If the reader of this message, regardless of the address or routing, is not an intended recipient, you are hereby notified that you have received this transmittal in error and any review; use, distribution, dissemination or copying is strictly prohibited.  If you have received this message in error, please delete this e-mail and all files transmitted with it from your system and immediately notify COCC, Inc. by sending reply e-mail to the sender of this message.

Thank you. ***

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).