> The filtering-side bad news is that (as noted) the filter can't
> do much about parsing it, and what is worse for SpamAssassin

Well, since the part order is recognizable the first part should be parsable
for up to its length, which is likely to be large. Since there is already
talk (if not actual code) in SA to only scan the first 64K or so of various
message parts, I can't see any problem with just scanning the first 64K or
so of the first part.

Although frankly I'd be inclined to just pass the whole thing through
without scanning. The chances that a spammer with even a huge botnet is
going to be sending 100MB multipart spams to obscure his 26KB gif image of
pills in the last part is pretty small, because it will kill his throughput,
and will likely get lost or corrupted along the way.