how to find what is causing the block

[skootsu]

We have an issue where we have problems with attachments (pdfs) getting deleted because they had something that hit a rule. We absolutly can't find anything that is on the rule list to trigger it. Is there any way you can get at the information for the Exact content/item that caused a match on the rule? The log just tells us the rule that was violated and the rank. I have 8 emails each with a one page pdf attached. None have a subject (noted in the log but not blocked for that reason) 1,2,3 and 7 were deleted and 4,5,6,8 came through with no problem. the only difference between those that made it is a 5 number combo (like Order number 56214 worked but 56371 did not) yet we don't have any numbers in any rule?
Any tips? Is there anyway to add the 'offending item' to the message so we can tell our users what the problem is when their email is blocked? This is happening both internal/out or out/in or in/in.

 

[skootsu]

Ok folks, after multiple attempts to cover bit by bit areas of one that is getting snagged, we have narrowed in down to the invoice number (51782) and still don't see how this would snag.
Heres the freaky thing, we figured out that if you rotate (can't believe this!) the document it makes it through!!
Help? Why on earth would rotating the doc (8 1/2 x 11) would have any effect with the spamkiller? And yes, we turned it on its side and the invoice number doesn't look like any letter combination of something on the rule list.
We are baffled!
I guess I should say the pdfs are created from a copier, two different copiers, same effect.