I think we've detoured from the actual problem?

The fact is that lots of spam is now being sent to other sites,
pretending to be from (collectively) our email addresses, so that we get
the bounces containing the spam. And SA isn't marking these messages as
spam, whereas if it was directly sent the same spam, it would.

So how do we fix this situation? What about getting SA to "detach" the
associated bounced message as a separate message and score that instead?
I know I can casually just say that - doing is a different matter - but
isn't that really the only answer to this problem?

How are others (successfully) handling backscatter? Moving bounces into
yet another separate folder isn't a solution for our users - and I'm
sure the same applies elsewhere. Spam is spam...

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1