Found to be spam, but subject not modified?

[Julian Field]

<x-flowed>
It's got a faulty Subject line. There should always be a space after the
word "Subject:". There isn't in this one.
I'll make the code more tolerant for the next release.

At 14:24 13/10/2004, you wrote:
>This email (headers follow) was clearly spam, and the
>X-MailScanner-SpamCheck header shows it was determined to be spam by
>SpamAssassin as well as a blacklist. But the subject line was never
>modified. Has anyone seen this particular issue? I took a look through the
>archives but came up blank.
>
>Most spam is properly tagged with {SPAM?} in the header, but not this one,
>and several others we received this morning. Any ideas?
>
>We're running MS 4.34.8, SA 3.0.
>
>...
>Received: from OUTGOING79.postalmailhostings.com (unknown [69.1.199.80])
>         by xxxx.cocc.com (Postfix) with SMTP id 3E2E47D06B6
>         for <MATTHEW.RICHARD at COCC.COM>; Wed, 13 Oct 2004 00:19:46 -0400
>(EDT)
>Date:Wed, 13 Oct 2004 00:19:45 -0700
>From: K2Smokes <sorogers at OUTGOING79.emailaccountzip.com>
>To: <MATTHEW.RICHARD at COCC.COM>
>Subject:$12.99 American Marlboro Cartons
>X-ID:1836957
>Mime-Version:1.0
>Content-type: text/plain
>Content-Transfer-Encoding: 7bit
>Message-Id: <20041013041946.3E2E47D06B6 at xxxx.cocc.com>
>X-MailScanner-cocci: Found to be clean, Found to be clean
>X-MailScanner-SpamCheck-cocci: spam, SBL+XBL, SpamAssassin (score=14.289,
>         required 7, autolearn=spam, BAYES_99 2.00, DNS_FROM_AHBL_RHSBL 0.29,
>         HTML_50_60 0.09, HTML_FONT_BIG 0.14, HTML_FONT_SIZE_LARGE 0.15,
>         HTML_MESSAGE 0.00, HTML_TEXT_AFTER_BODY 0.06,
>         HTML_TEXT_AFTER_HTML 0.03, MIME_HTML_ONLY 0.18,
>         MSGID_FROM_MTA_ID 1.72, RCVD_IN_SBL 0.11, RCVD_IN_SBLXBL 7.00,
>         SUBJ_DOLLARS 0.05, URIBL_SBL 1.00, URIBL_WS_SURBL 1.46),
>X-MailScanner-SpamScore-cocci: ssssssssssssss
>X-MailScanner-Information-cocci: Please contact the ISP for more information
>X-MailScanner-From: sorogers at outgoing79.emailaccountzip.com
>...
>
>Andrew Magnusson
>Internet Product Analyst
>COCC
>1-877-678-0444 extension 640
>
>
>
>--
>*** This message originates from COCC, Inc.
>
>If the reader of this message, regardless of the address or routing, is
>not an intended recipient, you are hereby notified that you have received
>this transmittal in error and any review; use, distribution, dissemination
>or copying is strictly prohibited.  If you have received this message in
>error, please delete this e-mail and all files transmitted with it from
>your system and immediately notify COCC, Inc. by sending reply e-mail to
>the sender of this message.
>
>Thank you. ***
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>