In article <745e678b4e.stuart@xxxxxxxxxxxxxxxxxxxxxx>, Stuart Painting <stuart@xxxxxxxxxxxxxxxxxx> wrote: > 3. Faulty address harvesting - one of the "address swiping" > routines used by spammers accidentally(?) prepends the surname > in the victim's address book to the email address. > delete to: = *paintingstuart@zedtoo* I've been using my equivalent, i.e. delete to: = *joycesteve* and one of today's mails was not stopped, despite containing 'joycesteve'. After much examination, there was no 'To' header, just 'Received for' containing 'joycesteve'. A new rule examining the 'Received' header works in the trial window, but I think I'll try making the mailbox more specific. That should dump all the ones containing random strings as suggected by Jeremy C B Nicoll. Steve