I've been noticing that mail from g...@vger.kernel.org is getting lots of points, and this seems like a recent change. Specifically, these rules are hitting on almost all messages:
* 0.1 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB * 3.8 TAB_IN_FROM From starts with a tab Looking back, it seems this mailing list is replacing From: user@domain with From:\tuser@domain for some reason. I can certainly reduce the score, but 3.8 strikes me as pretty high, and this seems to be a recently added rule. I see that this has been brought up before: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6429
pgp9YFudh6dar.pgp
Description: PGP signature