I found out what the problem is, and it seems like it should be considered a bug in SA. The text in question is in the second line of the body of the message, and it seems it is being ignored by SA, because if I insert a couple of LFs to move it down, the rule kicks in. I had tried changing it from "body" to "header" (also tried "rawbody) and that didn't work. Here is a look at the offending message, sans the html attachment:
Erm... That part looks all kinds of mangled... Any chance you can show us the REAL raw message, sans the HTML attachment.
Note that by "REAL raw" I mean with real headers, inclusive of mime boundaries.
I suspect the message in question has the "see attachment" text directly after a Content-Transfer-Encoding: section header with no line break. I've seen some floating around like that, and they are intentionally creating a malformed message knowing many mime parsers will treat it as a header, not a body text.
I'd suggest trying your rule as a "full" type rule, instead of body, rawbody, or header type.
Full should be run on the whole message, without any mime-stripping.
