Detecting X-Mailer Forgery

Mass analysis of spam and nonspam headers supposedly from "Outlook Express"

All the legit Message-ID headers had a common feature

      Message-ID: <00e601c4926f$468d5870$....
      Message-ID: <008901c48e89$3efc91a0$....
      Message-ID: <0b5301c49704$2741bee0$....
      Message-ID: <006d01c493f3$c570da60$....
      Message-ID: <002801c32fd1$5f6598f0$....