[Tim]
>> Why would spam be likely to end up with two instances of Return-Path
>> in the headers?
[Greg Ward]
> Possibly another qmail-ism from Bruce Guenter's spam collection.
Doesn't seem *likely*, as it appeared in about 900 of about 14,000 spams.
It could be specific to one of his bait addresses, though -- don't know.  A
nice thing about a statistical inferencer is that you really don't have to
know why a thing works, just whether it works <wink>.
> Or maybe Anthony's right about spammers being stupid and blindly copying
> headers. (Well, of course he's right about spammers being stupid; it's
> just this particular aspect of stupidity that's open to question.)
I'm going to blow it off -- it's just another instance of being pointlessly
baffled by a mixed corpus half of which I don't know enough about.

Anthony> They weren't partitioned in any particular scheme - I think
Anthony> I'll write a reshuffler and move them all around, ...
Hmmm.   How about you create empty Data/Ham/Set[12345], stuff all your
files into a Data/Ham/reservoir folder, then run the rebal.py script to
randomly parcel messages out to the various real directories?
I suspect you can pull the same stunt for your Data/Spam stuff.
Skip

[Skip]
> Hmmm.   How about you create empty Data/Ham/Set[12345], stuff all your
> files into a Data/Ham/reservoir folder, then run the rebal.py script to
> randomly parcel messages out to the various real directories?
I'm afraid rebal is quadratic-time in the # of msgs it shuffles around --
since it was only intended to move a few files around, it's dead simple.
An easy thing is to start the same way:  move all the files into a single
directory.  Then do random.shuffle() on an os.listdir() of that directory.
Then it's trivial to split the result into N slices, and move the files into
N other directories accordingly.
> I suspect you can pull the same stunt for your Data/Spam stuff.
Yup!

from localhost (jalapeno [127.0.0.1])
	by example.com (Postfix) with ESMTP id 308AA16F16
	for <zzzz@localhost>; Tue,  8 Oct 2002 10:55:37 +0100 (IST)
from dogma.slashnull.org (localhost [127.0.0.1]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g9880QK06040 for
    <zzzz@example.com>; Tue, 8 Oct 2002 09:00:26 +0100
From rssfeeds@example.com  Tue Oct  8 10:55:40 2002