An impossible exchange transport rule?

[nicksheppard]

Tried to find a way to do the following but without success..

We have a load of junk mail that comes in. We reckon a business we dealt with was compromised as all the junk comes to three specific addresses that were only given to this one business. i.e. junk email with three given recipients

So, I want an exchange transport rule that can target emails sent to address1 AND address2 AND address3....

Change the AND to an OR and it's the simplest thing in the world. But I want the AND....

Any thoughts?

 

[Zelandakh]

Do you have an anti spam bridgehead that could do it?
Check the header on a couple of the emails - is the source server the same each time as you could block it that way which would be easier.