Minor improvements
made check_suspect public, and sniff each message routed rather than log it