> I now have a folder full of emails from legitimate users with verified
> spam as attachments - the spam attachments appear to have all headers.
>
> Can i just run "sa-learn --spam" on that folder? Does spamassassin know
> to only look at the attachment?
No and no.
> Or do i somehow have to extract these attachments first?
'Fraid so.
Likely someone already has some tools to do this sort of thing, but I don't,
so can't help there.
>
> Any help would be most appreciated (i have been running sa-learn on the
> whole folder, and am thinking that that might be wrong!)
Yea, it has learned that the headers from the users themselves constuitute
spam keys, which probably isn't a real good thing for overall filtering
accuracy. It has also learned to associate any filtering headers in the
forwarded messages as part of the spam.
Loren
