[Esd-l] X-Unsent: header as way of recognizing mass mailing worms

[Brett Glass]

I've recently noticed that only transmissions by worms (Badtrans.B and 
Nimda.E) seem to contain an X-Unsent: header. Because it's characteristic 
of several worms, it may be that worm writers are re-using code that 
inserts it. It might be useful to have a local recipe that checks for 
this header and quarantines.

--Brett