Interesting set of rules, they look like they should do fairly well. I'll
run a masscheck on them in a minute. If they are decent I'm sure SARE would
be happy to include them in the stock spam ruleset if you give permission.
The only thing I see that makes me a little nervous is the unescaped @ in
the first rule. This is probably working because it isn't followed by an
alphabetic character. Also you have a few .* or other .+ globs. It's
always better to do a {0,something} or {1,something} size limit on these to
keep them from running away in unexpected conditions.
You are correct that rawbody rules are largely useless, since they won't
allow any multiline checking. There is flatly no way to check more than one
line in a rawbody rule, so you are forced into using full for this sort of
thing. A long-standing gripe of mine.
Loren
