-header SUBJECTSPAM subject =~ /\*\*\s*spam\s*\*\*/i
-describe SUBJECTSPAM Subject contains **spam**, so it's probably spam
+header FROMSPAMCOP from =~ /spamcop\@/i
+describe FROMSPAMCOP Message from spamcop@somedomain
+score FROMSPAMCOP 3.5
+
+header SUBJECTSPAM subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
+describe SUBJECTSPAM Subject contains **spam** or [spam], so it's probably spam