[spambayes-dev] default to mine_received_headers=True, "may be forged"

[Richie Hindle]

[Skip]
> It's interesting that you seem to have a lot of HELO's with the same value.
> Frequent correspondents perhaps?

Based on looking at a couple of examples, each unique HELO corresponds
with one person.  "HELO lion", for instance, is David LeBlanc.  From the
spams, "HELO kos" are all instances of the same spam.  "HELO pm69" are all
opt-in spams from Interseer, a service that watches your website uptime at
the cost of (very mildly) spamming you.

> I don't see that many HELO's (some from localhost).  Are they generated
> close to your machine (in a late Received: header)?

The three I looked at were all in the initial Received header - that is,
the one that was added by the first MTA, and therefore appears last in the
message.

-- 
Richie Hindle
richie at entrian.com