FYI, so far there have been zero false positives, and the only negatives are a Taiwanese spammer whose attachments are strictly a MIME-encoded GIF image with no text. This means that Mozilla has to latch onto a scarce few e-mail headers that look suspicious (e.g., "Received: from mydomain.com ..."). Assuming I get more from the GIF-only spammer, Mozilla should eventually learn some useful patterns...