Yes, there are a number of rules designed to catch exactly this behavior. Look in 20_head_tests.cf for the '*SUSP*' rules. They catch both the stuff you mention below, and even do a pretty good job with stuff like:
To: erica@blah Cc: erica@foo, eric@bar, ernie@baz C on 1/31/02 9:07 AM, Greg Ward at [EMAIL PROTECTED] wrote: > Someone on the Exim list is trying to filter out messages that look like > this: > > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], > [EMAIL PROTECTED], [EMAIL PROTECTED], > [EMAIL PROTECTED], [EMAIL PROTECTED], > > ... ie. same local-part repeated many times in various recipient > headers. Seems like a good spam flag to me, but I don't recall seeing a > rule like this when browsing SA's current ruleset. Is it there? > If not, should it be added? > > Greg _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
