I've had a few FPs on a legitimate mail from someone who apparently enjoys large fonts and a logo. I'm using network tests but not bayes and these are the stock rules being hit along with their scores from sa- update:
EXTRA_MPART_TYPE 0.815 DK_POLICY_SIGNSOME 0.001 TVD_FW_GRAPHIC_ID1 2.100 HTML_MESSAGE 0.001 HTML_FONT_BIG 0.256 PART_CID_STOCK 1.000 PART_CID_STOCK_LESS 1.000 Total: 5.173 In stock install it's just over the default threshold of 5 so if someone wants samples for a ham corpus I can provide a couple. Fwiw their mailer is Microsoft Outlook Express 6.00.2900.3028 Kevin