Detecting X-Mailer Forgery, 2

Outlook Express includes the current DATETIME when generating Message-IDs

      Message-ID: <0b5301c49704$2741bee0$....

generate correct timestamp from Received header data, and compare

Spam often used random values, or values that didn't match the Received headers

Result: the MSGID_OUTLOOK_INVALID rule, hit 25% of spam