Microsoft Outlook users have the ability to see the actual Internet message headers. This is done by selecting the View-Options from the main menu.
Normally Outlook will strip out these original Internet headers when forwarding the spam sample to CMS. So, please select, copy, and paste these headers into the forwarded message so that we may examine them and suggest some useful criteria for additional filters.