In article <5eb869214f.ricp@xxxxxxxxxxxxxxxxxxxxx>, Richard Porter <ricp@xxxxxxxxxxxxxxxx> wrote: [snip] > I've been following a false trail. The spurious message was processed > by AntiSpam at 00:45:57 on the 11th. The matching message was received > at 16:36:05 on the 10th and was processed normally. It contained a lot > more text both before and after what you see above. The log at the end > of the 00:45:55 session looks like this: [snip] > So was it abnormal behaviour by the server, or did something in the > last message cause AS to get its knickers in a twist? Hard to tell (for me) without looking at the relevant section of the actual log file. Could you send me the bit dealing with that entire session, in a zip? Regards, Frank