This seems to be working for me. So far. :)
## Annoying/dangerous messages
#
## Quarantine BADTRANS that have _email at addresses
:0 H
* ^Content-Type:.*multipart/
{
:0 H
*^From.*[\ <]_.*\@.
{
LOG='REJECT BADMAILER'
:0
BADMAILADDR
}
}
-------------------------------------------------
joel anderson * joela at nts.umn.edu 612-625-7389