Seen on the SpamAssassin users list: <URL: http://www.virusbtn.com/resources/viruses/indepth/junkmail.xml > Note the section on hiding stuff in RFC822 header comments.