I know you're going to tell me to feed email to Bayes to train it, but that's a problem: I'm using the SA boxes as spam-filtering relays to my internal GroupWise system. I've yet to figure out a way to get the email back to the box for learning.
Groupwise full-mail extraction tip:
Groupwise does actually keep a full copy of the original message, although they hide it from you and make it difficult to forward it anywhere. If you "view" instead of "open" the message it will show you a file named mime.822.. That's the full original email.
I've also had some moderate successes with GroupWise's "forward as attachment", but you'll have to experiment a bit. Forward it to an account on your forwarding mailserver that doesn't get forwarded.
