Stan Ryckman corrected my response to Gary Sutter:
| Huh? Both of you guys would pick off all mail containing both From:
| and Received: headers, I think, and that's most mail. The request
| was for Received: *after* From: (which, while it doesn't indicate spam
| specifically, generally shows up in mail sent originally without
| From: and which has had that header added later using the envelope).
Thanks to Stan for catching that. He's absolutely right ... I overlooked
Gary's subject and text to go by his suggested code, which would operate on
any mail with both From: and Received:; as Stan said, that's virtually all
mail.
| I think you want something like:
| :0
| * ^From:.*^+Received:
| { ACTION }
|
| (does that work as written though?)
Almost:
* ^From:(.+^)+Received:
I find it conceptually easier to use $ rather than ^ for embedded newlines,
but the two work equally well in this instance.