This shows a real spam collected in a user quarantine. This shows the headers of the messages with the X-MailCleaner anti spam tags and filtering process

Received: by mailcleaner.example.net stage2 with id 1X2m7U-0008AG-Ew
for <john.doe@example.net>; Thu, 03 Jul 2014 20:52:32 +0200
Received: from hermes.apache.org ([140.211.11.3] helo=mail.apache.org)
by mailcleaner.example.net stage1 with smtp
(Exim MailCleaner)
id 1X2m7T-00089p-CI
for <john.doe@example.net>
from <users-return-103947-john.doe=example.net@spamassassin.apache.org>; Thu, 03 Jul 2014 20:52:32 +0200
Received: (qmail 4963 invoked by uid 500); 3 Jul 2014 18:52:25 -0000
X-MailCleaner-SPF: pass
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:users-help@spamassassin.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@spamassassin.apache.org>
List-Post: <mailto:users@spamassassin.apache.org>
List-Id: <users.spamassassin.apache.org>
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 4942 invoked by uid 99); 3 Jul 2014 18:52:25 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 03 Jul 2014 18:52:25 +0000
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
tests=RCVD_IN_DNSWL_NONE,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of brentk@cfl.rr.com designates 107.14.166.227 as permitted sender)
Received: from [107.14.166.227] (HELO cdptpa-oedge-vip.email.rr.com) (107.14.166.227)
by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 03 Jul 2014 18:52:21 +0000
Received: from [68.204.117.149] ([68.204.117.149:55484] helo=VettePC)
by cdptpa-oedge01 (envelope-from <brentk@cfl.rr.com>)
(ecelerity 3.5.0.35861 r(Momo-dev:tip)) with ESMTP
id BE/BB-17005-C46A5B35; Thu, 03 Jul 2014 18:51:56 +0000
From: "Brent Kennedy" <brentk@cfl.rr.com>
To: <users@spamassassin.apache.org>
Subject: remove
Date: Thu, 3 Jul 2014 14:51:51 -0400
Message-ID: <059101cf96ef$db8ced70$92a6c850$@cfl.rr.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
thread-index: Ac+W79nzjbaCcrjgRFG4c9+kNmj4iA==
Content-Language: en-us
X-RR-Connecting-IP: 107.14.168.118:25
X-Cloudmark-Score: 0
X-Virus-Checked: Checked by ClamAV on apache.org
X-Commtouch-ctIPd-RefID: tid=0001.0A0C0302.53B5A671.0009
X-Commtouch-ctasd-RefID: str=0001.0A0C0205.53B5A671.002F:SCGSTAT1067355,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=1024
X-Commtouch: is not spam (Spam: Unknown, VOD: Medium)
X-NiceBayes: is not spam (89.44%)
X-Spamc: is spam (5.3/5.0)
X-MailCleaner-Information: Please contact support@example.net for more information
X-MailCleaner-ID: 1X2m7U-0008AG-Ew
X-MailCleaner: Found to be clean
X-MailCleaner-SpamCheck: spam, Spamc (score=5.3, required=5.0,
MC_NICEBAYES_80 4.0, RCVD_IN_RP_RNBL 1.3, TVD_SPACE_RATIO 0.0)
X-Auto-Response-Suppress: DR, NDR, RN, NRN, OOF, AutoReply

remove