Process on Message-ID header contents?

[Lew Wolfgang]

  Hi Folks,

I've been getting blasted with porn-spam from hotmail.com for the past few weeks.  
The spam has been getting past my (rather old) MailScanner installation.  It would be 
nice to just block everything from hotmail, but that won't work due to much 
legitimate traffic from there.

I've noticed that there are always two "To:" addressees, the one legit plus one to 
*@live.com or *@wanadoo.fr.  I tried making a blacklist rule to block on these 
addresses, but the one good address on the To: header is enough to complete 
delivery.  Also, all of spams have a common domain in the Message-ID:  *@phx.gbl.

Is there any way to have a blacklist.rules rule trigger on any "one" hit in the To: 
header?  Alternatively, is there anyway to process based on the Message-ID header?

I'm sure there's a way to do this with spamassassian or procmail, but I'm rather 
rusty on both of them.

Thanks,
Lew Wolfgang