Can anyone tell me how Outlook express gets a positive hit using this rule:
======
Where the from line contains:
suntrust or charterone.com or citizensbank.com or wamu.com or regions.com or key.com or southtrust.com or charteronebank.com
or
Where the subject line contains:
'Please confirm your account' or 'Your details have been compromised' or 'account suspend in progress' or 'KEY-Security Alert'
or
where the message body contains:
'confirm your account' or 'access to buy or sell on eBay will be restricted'
move it to the Spoofs folder
and stop processing more rules
===
and this is the email that was sent to the Spoofs folder (In this source listing I only changed our actual location to myco.com and the email addresses to user#@myco.com, and the SMPT id in case that identifies us. THis is at work so I don't want to give out anything that could come back to haunt me. :-0 )
-----------
Return-Path: <garyrubal@spankthedonkey.com>
Received: from spankthedonkey.com ([222.65.57.24])
by myco.com (8.11.6/8.11.6) with SMTP id T471ZZYS4251;
Mon, 6 Jun 2005 23:20:21 -0400
Message-ID: <b33e01c093e8$75afb8c0$fe039202@garyrubal>
From: ''cordelia fields'' <garyrubal@spankthedonkey.com>
To: ''''elouise banks'' leonid@linkfive.com'' <user1@myco.com>
Cc: <user2@myco.com>, <user3@myco.com>
Subject: become the man that women desire
Date: Sun, 11 Feb 2001 05:06:58 -0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=''----=_NextPart_367_6C5F_0DB040B6.435A8FB7''
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Status:
This is a multi-part message in MIME format.
------=_NextPart_367_6C5F_0DB040B6.435A8FB7
Content-Type: text/plain;
charset=''us-ascii''
Content-Transfer-Encoding: quoted-printable
------=_NextPart_367_6C5F_0DB040B6.435A8FB7
Content-Type: text/html;
charset=''us-ascii''
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC ''-//W3C//DTD HTML 4.0 Transitional//EN''>
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D''text/html; charset=3Dus-asci=
i''>
<META content=3D''MSHTML 5.50.4133.2400'' name=3DGENERATOR>
<STYLE></STYLE>
</HEAD><FONT face=3DArial><FONT size=3D2>
<BODY>
<DIV>
</DIV></BODY></HTML></FONT></FONT>
------=_NextPart_367_6C5F_0DB040B6.435A8FB7--
--------------------------------------------
I see nothing in this email that would trigger the filter. Similar things have happened in the past with other filters.
Any ideas? This is OE 6 on Win XP home.

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic