It seems there are a lot of anti-spam headers which if they are seen
on incoming email is a fairly good indication that the message is
spam. Kaspersky Anti-Spam is one such puppy with its often appearing
X-Spamtest-Munged-Info header. That appears in exactly one folder on
my system with a 3 gigabyte mail corpus, the Spam directory.
Now, it may be that on a given system spam may get filtered twice
So a SARE rule set with all known anti-spam headers in it with a
clearly delineated set of score overrides that can be uncommented
is called for. That way somebody stuck behind a KAS system who runs
his own spamassassin can still use the rule with the X-SpamTest-Info
score set to zero. Most users will simply leave the rule on with a
fairly secure medium to high score and capture a large chunk of spam
very reliably.
{^_^}
