[Mimedefang] German spam (related to new worm Sober.q)

[Joseph Brennan]

It sends a bad HELO string, and the address shown in the To: header
line is not only bogus but it is not one of the recipients.

Other than this, it's pretty good.  It does not contain a virus, it's
not html and it has reasonable looking message and mime headers.

I wish I had time to implement greylisting right now.  What are you
folks using on large systems?  Can you point me to a web page?

Joseph Brennan