[imp] Spam query

[Simon Wilson]

Hi list,

My mail setup is doing a great job of keeping spam out of my inbox,  
but I have a puzzle...

I have a postfix setup that filers incoming email through amavisd-new,  
including spamassassin. It is configured to dump nothing, but send all  
email on, including spam, to Cyrus IMAP, where a sieve script (set up  
using Ingo) includes:

  # Spam Filter
      10: if header :comparator "i;ascii-casemap" :contains  
"X-Spam-Level" "*****"  {
      11:     fileinto "INBOX/Spam";
      12:     stop;
      13: }

So as i read that, spam that is flagged over 5 is routed into INBOX/Spam...

True enough, in that folder are a lot of spam emails. BUT many of them  
are NOT *****... for example this is in my Spam folder:

X-Virus-Scanned: amavisd-new at simonandkate.net
X-Spam-Flag: NO
X-Spam-Score: 0.908
X-Spam-Level:
X-Spam-Status: No, score=0.908 tagged_above=-999 required=6.2
	tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, RP_MATCHES_RCVD=-0.001,
	SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no

The email IS spam, so I'm not complaining that it's in there - but I  
can't see WHAT put it in there. I'm getting a couple of false  
positives which got me looking to see what spam is getting flagged.

I realise it's likely not a Horde issue, but just seeking to tap into  
the expertise here.

What am I missing...

Thanks
Simon.

-- 
Simon Wilson
M: 0400 12 11 16