X-Mailer: Microsoft Outlook Express 6.00.2600.0000
from domain always starts with [0-4ab] (auracom.com and about.com are common domains)
In and of itself, these don't explicity flag as spam, but are useful to detect new strains when the name changes.
[A-Z][a-z]+ ([A-Z]\. )?[A-Z][a-z]+ <.*@[0-4ab] is a good pattern for finding them in the From: header
Messages from "SEO Action Team" encoded as =\?iso-8859-1\?B\?U0VPLUFjdGlvbiBUZWFt\?= also seem to folow the same @[0-4ab] pattern
Frank J. Hall showed up on November 19, then left on November 21.
Alice A. Walker mails seems to have dried up n November 26, with nothing, so far, replacing them.
Alice and Frank both returned and brought along Emily A. Jones on Dec 8, 2004.