Reject mails with two different mail addresses in From Header

[Nikolaos Milas]

Hello,

Is there a way to drop mails which have two different mail addresses in the From header?

This is a common trick of abusers.

For example, mails with a header like:

From: "<John Doe> john_...@example.com" <afom-semin...@grandmashotels.com>

This is from a real mail (with a password-protected zip attachment) which obviously is infected.

Can you please provide some amavis/SA setting(s) and/or script doing that job?

Any other suggestions?

Thanks in advance.

Cheers,
Nick