I have been fighting poor spam filtering performance on my Zimbra server for months now, and it seems the most frustrating aspect of it is that my bayes database gets poisoned with spam within a couple of weeks of being reset.
I did this about two weeks ago, and today I noticed many obvious spam, following the same pattern as spam I have been marking as Junk for the past two weeks, ending up with a BAYES_00 test hit. Is there anything I can do to make the bayesian filter not recognize these as ham? I'm not exactly clear as to why they are hitting on this test, actually - are all messages trained as ham until such time they are marked as spam? I did an initial import of about 3,000 ham messages, but since that time I haven't trained anything as ham. Yet, clearly it thinks these are ham.
What about giving a BAYES_00 test a score of -0.001 instead of -2.599? That would catch a TON of our spam, and I'm not sure that it would allow many ham to be recognized as spam - the BAYES_00 test seems to catch more junk than real ham anyway.
Any other good strategies out there? I am also thinking of upping the score for SPAMCOP_BL to like 3.5. I don't see too many false positives coming from that test.
Overall, our filter performs at about 74% efficiency on my inbox and lets through many obvious stock and drug sale spam (not just the GIF-based ones, even the text based ones). One user had 800 spam to 13 ham waiting for her this morning from the weekend. Users are starting to revolt. :-/
All ideas appreciated!