I have 2 messages, where the bodies are the same.
No, you have two messages with similar bodies, but they are definitely not the same.
There's a lot of the same text, but the last line and the subject are very different in each.
SA handles the subject line as if it were body text. Thus, because one had actual drug names in the subject line, some of the DRUG_* rules fired, increasing the score. That's 1.1 points of difference.
There's no actual drug names in the subject or body of the untagged mail, except in URLs. It looks like spammers are adapting to bypass antidrug's rules by hiding text in links.
They also hit different BAYES_* due to their differences. The tagged one got BAYES_95, but the untaged one got a very weak BAYES_60. That's 1.71 points of the difference.
The one that got tagged also hit one of your SARE add-on rules, another 1.7 points.
Now, the untagged message did hit a few extra rules, RCVD_IN_BL_SPAMCOP_NET (+1.2)
1 scored 3.5, the other 6.3
Why is this? Way to may MEDS are coming through.
The best thing you can do right now is work on your bayes training a bit. That untagged mail missed 1.7 points of score by matching your bayes training very weakly.
I'll look into making a URI version of antidrug for SA 3.0 when I have some spare time.
