Rule for lack of To and CC headers?

[Casey Allen Shobe <cs...@osss.net>]

I've been seeing some (real estate software) spam without any To or CC 
headers at all.  Wouldn't this be a good candidate for a new rule, as 
all valid mail has a To or CC header of some form (I believe RFC demands 
it)?

Here are example headers from one such message:

Received: (qmail 11503 invoked by alias); 9 Apr 2004 05:07:48 -0000
Delivered-To: scott@thebrittinggroup.com
Received: (qmail 11497 invoked from network); 9 Apr 2004 05:07:46 -0000
Received: from c66.191.139.186.static.roc.mn.charter.com (HELO 
notinschool486.com) (66.191.139.186)
   by 199.72.170.146 with SMTP; 9 Apr 2004 05:07:46 -0000
From: Robert Carter <Ro...@notinschool.com>
Reply-To: robert@notinschool.com
Subject: Calculate Cashflow
Date: Fri, 09 Apr 2004 00:01:00 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed; 
boundary="5321cfa9-b8e4-42c8-aa6b-bee7ed881fcf"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
	hydrogen.thebrittinggroup.com
X-Spam-Level: ----
X-Spam-Status: No, hits=4.3 required=5.0 tests=BAYES_60,MIME_BOUND_MANY_HEX
	autolearn=no version=2.63

Cheers,

-- 
   Casey Allen Shobe  |  http://casey.allen.shobe.info
     cshobe@osss.net  |  ICQ: 1494523  |  AIM: SomeLinuxGuy
       Open Source Software Solutions  |  http://osss.net