first message spam, next spam gets whitelisted?

[Fractal IT Dept.]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi everyone,

I'm seeing a bunch of messages these days that look like this:
[  ] 29/03/05 06:29:57 itbe_1e3925a6a26ccc4b151239a39c588a...
sara at localdomain1.com {**Spam?**} IT Secur... 35.6Kb 7.75 W/L
[  ] 29/03/05 06:29:40 itbe_1e3925a6a26ccc4b151239a39c588a...
sara at localdomain0.com IT Security--Ignoran... 33.7Kb 6.06 Spam
So from what I can see, a message comes in to this user and is correctly
tagged as spam. Then 27 seconds later, another (likely duplicate) message
from the same spammer comes in for the user's email address on her other
address, gets even higher spam but is whitelisted. Needless to say, this
spammer is not in the spam.whitelist.rules file.

Obviously my question is: how do I stop this from happening? And why is a
higher scoring message being let through to the user's inbox as
whitelisted (when it isn't) when an identical message only seconds before
was correctly tagged?

Thanks,
Chris
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!