[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] ING Direct mail FPing on TVD_ rules

["babedh-dhra@biggdog.biz" <ba...@biggdog.biz>]

I just received a mistagged-ham report from a customer showing two stock 
rules hit on a legitimate email from ING Direct - total score was 6.4, 
even with -3.5 from BAYES_00.  I've asked if I can pass the message on 
for analysis.

Stock scores:
score TVD_PH_SUBJ_ACCOUNTS_POST 2.602 2.607 2.497 3.099 # n=2
score TVD_SUBJ_ACC_NUM 0.001 2.199 2.199 2.198 # n=1

I've dropped them down like so:
score TVD_PH_SUBJ_ACCOUNTS_POST 1.1 1.1 1.0 1.5
score TVD_SUBJ_ACC_NUM 0.001 1.199 1.199 1.198 # n=1


The full set of hits (mostly stock rules, the ones that aren't have low 
advisory scores):

Content analysis details:   (6.4 points, 5.0 required)

  pts rule name              description
---- ---------------------- 
--------------------------------------------------
  1.0 SUBJ_YOUR_DEBT         Subject contains "Your Bills" or similar
  2.2 TVD_SUBJ_ACC_NUM       Subject has spammy looking monetary reference
  3.1 TVD_PH_SUBJ_ACCOUNTS_POST TVD_PH_SUBJ_ACCOUNTS_POST
-0.0 T_RP_MATCHES_RCVD      Envelope sender domain matches handover relay
                             domain
  0.1 PERSONAL_INFO_11       BODY: PERSONAL_INFO_11
-3.5 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                             [score: 0.0000]
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  1.1 HTML_IMAGE_ONLY_16     BODY: HTML: images with 1200-1600 bytes of 
words
  0.0 TO_EQ_FM_HTML_ONLY     To == From and HTML only
  0.0 TO_EQ_FM_DIRECT_MX     To == From and direct-to-MX
  1.7 TO_EQ_FM_HTML_DIRECT   To == From and HTML only, direct-to-MX

-kgd