My understanding of your post is that you want to catch a 'to' with "@ntlworld." that isn't followed by "com". Assuming that is right, then I think something like the following (completely untested!) rule might work:
header NOT_NTLWORLD To~= /[EMAIL PROTECTED](?!com)\w/ This should catch anything with <word>@ntlworld.(!com), so should trip on what you want. I would have to check the :addr variant to see if it included all of the addresses in the list, or only the first one. If it includes all, then you could delete that first \w in the re. Loren