In the past six month it seems like 95% of the SPAM getting past our SA configuration is coming from Google, as they are well formatted and missing most of the obvious triggers. Anyone figured out a way to identify them? Lee