Hii just started to play with "pyzor" according to https://wiki.apache.org/spamassassin/UsingPyzor which seems to work fine in general
*but* i recentyl got an offer with two lines text, a footer.logo and a PDF attachment as well as a twitter-notify flagged with PYZOR_CHECK which makes me wonder which parts of a message are taken for the checksums
signature.asc
Description: OpenPGP digital signature