Exchange users are getting the X-Ham-Report:
Spam detection software, running on the system "fooserver", has identified
this incoming email as possible spam. THe original message has been
attached to this so you can view it or label similar future email."
It seems to be limited to emails that have just barely missed the mark for spam detection. Content analysis usually shows that the spam score ranges from 2.4 - 3.4 (in this sample of emails) when a 2.0 is required.
Of the 9 samples I just received from a user, 1 is legit (from hover.com) and the others are trash.
I would like to funnel these into a specific folder in exchange. How can I do that? Or, in the alternative, how do I tell Spam Assassin to just stop sending them?
Edit: Spam Assassin is installed on a Debian 8 Linux mail gateway that receives mail from the outside world, filters it, and the forwards it on to the Exchange server. That's probably important here.
If something is being written in to the headers, then the easiest method would be to write a transport rule that sees the header and makes the SCL value 7 or 8. That should put the email in to the end user's junk email folder automatically.