 barry a warsaw gives answers and asks questions here s the code that produced the header tokens xNUMBERn for x in msg keys xNUMBERn x xNUMBERn get x NUMBER NUMBER for x in xNUMBERn items yield header s d x some responses NUMBER NUMBER NUMBER NUMBER header x mailman version NUMBER NUMBER NUMBER NUMBER NUMBER header list id NUMBER NUMBER NUMBER NUMBER NUMBER header x beenthere NUMBER these three are definitely mm artifacts although the second one could be inserted by other list management software it s described in an rfc since all the ham came from mailman and only NUMBER spam had it it s quite safe to assume then that i should ignore these for now NUMBER NUMBER NUMBER NUMBER header newsgroups NUMBER NUMBER NUMBER NUMBER NUMBER header xref NUMBER NUMBER NUMBER NUMBER NUMBER header path NUMBER these aren t mm artifacts but are byproducts of gating a message off of an nntp feed some of the other nntp headers are similar but i won t point them out below i should ignore these too then NUMBER NUMBER NUMBER NUMBER header list unsubscribe NUMBER NUMBER NUMBER NUMBER NUMBER header list subscribe NUMBER NUMBER NUMBER NUMBER NUMBER header list post NUMBER NUMBER NUMBER NUMBER NUMBER header list help NUMBER NUMBER NUMBER NUMBER NUMBER header list archive NUMBER rfc recommended generic listserve headers that mm injects ditto so why do you get two entries for this one NUMBER NUMBER NUMBER NUMBER header received NUMBER NUMBER NUMBER NUMBER NUMBER header received NUMBER read the code wink the first line counts msgs that had NUMBER instances of a received header and the second counts msgs that had NUMBER instances i expect this is a good clue the more indirect the mail path the more of those thingies we ll see and if you re posting from a spam trailer park in tasmania you may well need to travel thru more machines note that header names are case insensitive so this one s no different than mime version similarly other headers in your list ignoring case here may or may not help that s for experiment to decide it s plausible that case is significant if e g a particular spam mailing package generates unusual case or a particular clueless spammer misconfigures his package NUMBER NUMBER NUMBER NUMBER header precedence NUMBER could be mailman or not this header is supposed to tell other automated software that this message was automated e g a replybot should ignore any message with a precedence bulk junk list rule of thumb if mailman inserts a thing i should ignore it or better i should stop trying to out think the flaws in the test data and get better test data instead NUMBER NUMBER NUMBER NUMBER header NUMBER NUMBER NUMBER NUMBER NUMBER NUMBER header heh i sucked out all the wordinfo keys that began with header the last line there was probably due to unrelated instances of the string header in message bodies harder to guess about the first line some headers of course are totally unreliable as to their origin i m thinking stuff like mime version content type to from etc etc everyone sticks those in the brilliance of anthony s just count them scheme is that it requires no thought so can t be fooled wink header lines that are evenly distributed across spam and ham will turn out to be worthless indicators prob near NUMBER NUMBER so do no harm 