Thanks guys for the replies, all of which added something useful.

I have now moved that rule to be first in the list; it already had the stop
processing bit there.

I am very concerned at this last point by Norman Miller. If the X-original
lines are ignored then the spammers have found an easy way round any rules
for the to or cc lines, and surely that's a near disaster.
Norman does not offer any solution.
--
Regards, Jack Sadie



"N. Miller" wrote in message
...
On Mon, 11 Aug 2008 09:42:55 +0100, Jack Sadie wrote:

Windows XP and OE 6.
I have made a rule requiring messages with "mcibatreasurer in the to or
from
lines" to be transferred to a special folder. With most messages this is
working well but a couple recently have remained in the in-box and I
expect
these are spam (if not more sinister).

Here is the message source for one of these :-

Return-Path:
X-Original-To:
X-Envelope-To:
Delivered-To:
Received: from 234-200-246-201.adsl.terra.cl
(234-200-246-201.adsl.terra.cl
[201.246.200.234])
by banzai.systems.pipex.net (Postfix) with ESMTP id 0E8B0E000087;
Mon, 11 Aug 2008 03:20:14 +0100 (BST)
Message-ID: 01c8fb37$446fa680$eac8f6c9@supports
From: "Evangeline Blake"
To:

The problem is that neither the "To:", nor the "From:" include the text
string, "mcibatreasurer".

MS Outlook Express does not look at the "X-Original-To:", or the
"X-Envelope-To:" lines. It does not look at any other header lines that
"From:", "To:" (and/or "Cc:"), and "Subject:".

--
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.