+header FROMABUSE from =~ /\babbuse\@/i
+describe FROMABUSE Message from abbuse@somedomain
+score FROMABUSE 1.5
+
+header FROMSPAMCOP from =~ /spamcop\@/i
+describe FROMSPAMCOP Message from spamcop@somedomain
+score FROMSPAMCOP 3.5
+
+header SUBJECTSPAM subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
+describe SUBJECTSPAM Subject contains **spam** or [spam], so it's probably spam
+score SUBJECTSPAM 3.5
+
+header MESBLOCKED subject =~ /your message (?:is )?blocked/i
+describe MESBLOCKED That's great that our message was blocked
+score MESBLOCKED 2