Hi, I thought I would look through the quarantine for "BAYES_00" to see if there were any mis-marked messages or if bayes was not firing correctly, and I have found a few, although not how I expected it would be.
Instead of finding BAYES_00 in spam, I've found it in ham that was pushed over the threshold to spam because of other rules. Here are the headers from one such instance: http://pastebin.com/m6c3cd5e3 "exxample.com" is my obfuscation. It was an HTML email with two small GIF attachments that were a basic background image and two links to youtube videos of a religious Muslim ceremony in Arabic with English subtitles. All indications are that bayes is correct and it's ham. Which rule(s) is then incorrect? What is the right solution here? Is the only option to whitelist the user? Thanks, Alex