header:
01: X-MSK: HYD=0.630075005
02: Return-Path: <mailing [at] newsletter.sskm.de>
03: Received: from murder ([192.168.8.180])
04: by backend2 (Cyrus v2.2.12) with LMTPA;
05: Tue, 27 Nov 2012 xx:xx:xx +0100
06: X-Sieve: CMU Sieve 2.2
07: Received: from mail.m-online.net (localhost [127.0.0.1])
08: by frontend1.mail.m-online.net (Cyrus v2.2.12) with LMTPA;
09: Tue, 27 Nov 2012 xx:xx:xx +0100
10: Received: from scanner-4.m-online.net (unknown [192.168.6.83])
11: by mail.m-online.net (Postfix) with ESMTP ID: [ID filtered]
12: for <poor [at] spamvictim.tld>; Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
13: X-Virus-Scanned: by amavisd-new at m-online.net
14: X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char FC hex):
15: From: "Stadtsparkasse M\374nchen" <mailing[...]
16: Received: from mxin-1.m-online.net ([192.168.6.164])
17: by scanner-4.m-online.net (scanner-4.m-online.net [192.168.6.83]) (amavisd-new, port
18: 10026)
19: with ESMTP ID: [ID filtered]
20: Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
21: Received: from patroklos6.teamware-gmbh.de (patroklos6.teamware-gmbh.de
22: [212.29.0.15])
23: by mxin-1.m-online.net (Postfix) with ESMTP ID: [ID filtered]
24: for <poor [at] spamvictim.tld>; Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
25: Received: from patroklos.teamware-gmbh.de (apollon.tmwr.de [212.29.6.11])
26: by patroklos6.teamware-gmbh.de (Postfix) with ESMTP ID: [ID filtered]
27: for <poor [at] spamvictim.tld>; Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
28: Message-ID: [ID filtered]
29: Date: Tue, 27 Nov 2012 xx:xx:xx +0100
30: From: "Stadtsparkasse MXnchen" <mailing [at] newsletter.sskm.de>
31: Reply-To: "Stadtsparkasse MXnchen" <newsletter [at] sskm.de>
32: To: meinname<poor [at] spamvictim.tld>
33: Subject: =?iso-8859-1?Q?Goldbarren_-_eine_gl=E4nzende_Geschenkidee.?=
34: Mime-Version: 1.0
35: Content-Type: multipart/related;
36: boundary="----=_Part_912131_29326746.1354024056984"
37: X-Source: T C921 S4278 M374850 U22043019
38: List-Unsubscribe:
39: <http://www.teamletter.de/kunden/sskm/direktmailing/sskm_unsubscribe.jsp?[UNSUB filtered]>
40: X-CSA-Complaints: whitelist-complaints [at] eco.de
41: List-ID: [ID filtered]
Ich bin Sparkassen-Kunde, habe aber garantiert keinen Newsletter bestellt. Die Stadtsparkasse behauptet, sie verschicke keine Newsletter.

Wer kennt sich mit Headern aus? Der falsche Umlaut im Header ist hoch verdächtig! Eine Google-Suche nach Patroklos-Teamware förderte ebenfalls nichts Seriöses zutage.

Vielen Dank
Wuschel