When the POP3 proxy blocks an email, the blocked message notification email has a truncated header-replace-x-spam-report and spam-report headers that are clearly missing some things. Example, the rules listed in the report don't come close to adding up to the 14.9 total score.
header-replace-x-spam-score 14.9
header-replace-x-spam-report 2.8 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
1.0 RCVD_BY_IP Received by mail server with no name
1.8 D
I've cleaned this one up to be readable, in the raw, it's one line that is truncated to fit in the report width.
This thread was automatically locked due to age.