I would really like to be able to have all IP addresses in the header checked instead of just the connecting one.  Often spam is routed from a blacklisted IP through another non-blacklisted IP.  This accounts for the majority of the spam that still gets through our system now.  Can this feature be added as an option?

Or have a list of "approved" relay IP's so that all the IP's in the header are only checked if connection was made from the list of approved IP's.  That would help to keep overhead down except when needed.

For some this would be help to clean up most of that last 10% that still get through, but for others it would not be feasible.  That is why I suggest that the feature be an optional one that can be turned on or off, and the idea of only using the feature only with certain acceptions to the normal check of the connecting IP. 

If anyone is going through the trouble of faking the header information with something that would trigger a hit though SpamFilter, I for one don't want that email to pass through anyway.  I don't want any email that cannot be tracked back to pass though.  Likewise if someone is sending mail through questionable channels, I wouldn't want that to pass though either.  Of course I can only speak for our case here, but having the option would be a powerful option.

I agree with your sentiments Dan about the embedded URL's and I sympathize with your situation where you as an ISP really cannot block them.  We DO block them and they account for 60% of the spam that we quarantine.   This, the nice RegEx, and a few choice keywords blocks 90% of the big problem spam.  But the backdoor spoofed IP method is still one that I would like to gat a handle on for the last 10%.  There was even a small mention of these escalating spam methods in an article in the current Network World.