I (as postmaster) have just received notice of a mail being quarantined because of an excessively long header. Looking at the logs, it would seem as though neither the sender nor recipient, only the $SECURITY_NOTIFY, was notified. Is this the correct behaviour, or do you think that they should also be informed?