Spammers adding SA Headers?

[Eggleton, Michael]

  I have been using the SA-Qmail-Scanner-1.23

 

  I'm being spammed with a spam message that looks like it targets getting past the quarantine.  This is very frustrating.

 

This is the header information that it has before Spamassassin ever sees the message:

 

X-Spam-Checker-Version: SpamAssassin 4.6-spambr_03823q on
 popsrv.ist.utl.pt
X-Spam-Level:
X-Spam-Status: No, hits=-4.3 required=4.0 tests=AWL,NO_REAL_NAME autolearn=no
 version=5.4-spambr_3284027975t
X-UIDL: FQRyZcZWC0

 

Then my Anti-Spam system does this:

 

Received: from 201.129.223.87 by SBTMS01 (envelope-from <[EMAIL PROTECTED]>, uid 502) with qmail-scanner-1.23st

Clear:RC:0(201.129.223.87):SA:0(-4.3/4.0):.

 Processed in 35.076658 secs); 19 Sep 2004 15:33:10 -0000

X-Spam-Status: No, hits=-4.3 required=4.0

Received: from localhost by SBTMS01
 with SpamAssassin (2.64 2004-01-11);
 Sun, 19 Sep 2004 11:33:04 -0400

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on SBTMS01
X-Spam-Level: *********************************************

 

My question is:

  Is it spamassassin that is seeing the other X-Spam-Status header and using it over again?  or is it SA-Qmail-Scanner?

 

  Also, my required is 4.5

 

As you can see, my spamassassin did mark this message very high "X-Spam-Level: *********************************************"  (As it should, it is real bad spam), but for some reason it has kept the setting the spammer set his spam to.

 

Thank you for any help you can give me.