Jul 26 07:58:20 vps spamd[7361]: spamd: result: . 2 -
HTML_MESSAGE,URIBL_SBL,URIBL_WS_SURBL
Jul 26 07:58:21 vps spamd[7361]: spamd: result: Y 7 -
BAYES_99,FORGED_RCVD_HELO,HTML_50_60,HTML_MESSAGE,URIBL_SBL,URIBL_WS_SUR
BL
There are two obvious differences here, Bayes and the forged header
complaint. I'd bet that most of the score results from Bayes.
I don't know enough about your system to really guess why Bayes doesn't seem
to be running the first time. Possibly you run as a different user, and
either bayes is disabled in user_prefs for that user, or there is a
permissions problem, or something else along those lines.
The forged helo rule is probably triggering because of a header added after
the first scan. It probably isn't adding a huge amount to the score.
spamassassin -D on that message would probably show up what it doesn't like
in the received headers.
Loren
