It's likely this could be a custom filter on the user or domain level. I would check those as those can be setup to prepend text on a subject based on the spam level. 

Dear Randy and Matt,

 

I have impersonated the admin user -- allan -- and I went to Content Filtering; but, no filters are there. (See screen capture.) Can you think of another place I might look for the***SPAM*** text that gets prepended to the subject line of this gentleman's wife's incoming emails? =) Thank you very much for your patient help. Gratefully,

 

Eric

 

 

Matt, good to hear from you, and thank you for the follow-up. I've hunted and tinkered around in the interface for quite some time now, looking for anything I might have overlooked. You know, I am not completely certain I have checked the domain level content filters. I am not sure where to find those. I attach a screenshot of what I am looking at. From here, where should I go? It seems to me that I have looked everywhere, clicked on everything. Obviously I am missing something. =) Thank you for your help. Eric

Hi Eric,  Try this:

At the end of the log returned, you'll see:  (Delivered) Filter:

If the filter says None, then no content filters were applied.  If there's a name after 'Filter:', then that is the content filter being applied.

Hi Eric. Are you using Declude by any chance? I'm asking because depending on your settings, it can add spam prefixes to message subjects.

Hi Eric.  I would next check Outlook's junk email settings.

 

Friends, I am pretty sure now that it's a Client Side thing. I see the headers of the incoming messages in SmarterMail web interface, and the ***SPAM*** subject line prepending is not there. But apparently those incoming messages are prepended once they get into Outlook.

Here is a header of one of the incoming messages. It looks normal to me; do you see anything untoward in this header?

Thank you again for your help. =)

Eric
 

Return-Path: <selma.m.thomas@gmail.com>
Received: from mail-yw0-f171.google.com (mail-yw0-f171.google.com [209.85.161.171]) by tarsier.viviotech.net with SMTP
(version=TLS\Tls12
cipher=Aes256 bits=256);
Wed, 18 Oct 2017 13:01:20 -0400
Received: by mail-yw0-f171.google.com with SMTP id l32so1136377ywh.13
for <allan@tallancomp.com>; Wed, 18 Oct 2017 10:01:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:in-reply-to:references:from:date:message-id:subject:to;
bh=4wpcHOOfhke2O4v+o6pJQ5T8q+1Zcu5mz7L2wsHxAdM=;
b=uhbDTsUC6HRqWII2KOPLAZ9Kx6REPOtQbT/zflN3DPBcYkofjaO5oNvpP9kIMYeMYV
pODNQJ4u0uZziMPR8YRbq01OkU/qHYqfjSoJ0ST4LB1x+3hNvTasDYTrPFBn2/2qXDIU
e9DW1LFiA4BPhuOgapTDficysC4EhP0RzjbTUKUqYlGjKDCBo1mJpDmQywuPDFxTpn2U
tAfQppHRzbUdQIz8g2Jn8oxj2GnyYtT0cYSZihQ7dtg/E4xgH3uMk9n7jzwPV06qiCSA
ec/2FGI0uylEf083Y5SgBQe7rstrUqXSaOt0lRRlEe1k+nz480ffIZ6NDAkgby4mAFlK
Kt6A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:in-reply-to:references:from:date
:message-id:subject:to;
bh=4wpcHOOfhke2O4v+o6pJQ5T8q+1Zcu5mz7L2wsHxAdM=;
b=oRO4M9ywtisrnVEWC05cWZ2z7e3MeS4rnMgCVz9YuMS/Uex173HJpgPqeDXjeNf2d0
hUrjnnxfXA6QQTMmXpfdolzT3glDMcwlHi5NJZ35bmT93PCFzMd2AJVVNNR2NQHGsyti
p6sZJm2+Eg4Sel2nnfMVh/DpE589n0RjNxhUuzrZz2Trbj4N9Tbc7/aE6hbMmwarNkad
mEPKA/lShhvXN/Z8VEVg3MF/oQDUhezWAeAR2YdzFgtuSD2FDlSxfCFEhsN+NuFDendx
d6HI/FQkBQ755ENtoYKAz7wjT1/JQoh715JfdeCjbM4Od9wy6mnrO9ESQTPKCKPHEUKh
6REQ==
X-Gm-Message-State: AMCzsaWYQYo51MRbIGS9LIHs5UFWD6zn4vwSnzEGl6iiVApQMQ9vI8uJ
Fmo8yGPdJ3Y3oxsF4gIXLUPzlH9HOh4SVRIZaiI=
X-Google-Smtp-Source: ABhQp+ReZAZszSHMnaVfGeP2QWBS4ftecLy9q5ybxm55B55VFEYWTKuj4QOEuBavVArfcc1hZMGeAthYDgjZarKjOEQ=
X-Received: by 10.37.224.76 with SMTP id x73mr5135496ybg.59.1508346073445;
Wed, 18 Oct 2017 10:01:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.23.10 with HTTP; Wed, 18 Oct 2017 10:01:12 -0700 (PDT)
In-Reply-To: <001501d34830$76860100$63920300$@com>
References: <001501d34830$76860100$63920300$@com>
From: Selma Thomas <selma.m.thomas@gmail.com>
Date: Wed, 18 Oct 2017 13:01:12 -0400
Message-ID: <CAP4Bzp9-ytorqfr+=+SgPEDZGRMHwa+a9oWOyQp5Zj8_TyO6AQ@mail.gmail.com>
Subject: Re: FW: Invoice and Virginia tax forms
To: "T. Allan Comp" <allan@tallancomp.com>
Content-Type: multipart/alternative; boundary="94eb2c088ce4e7fa95055bd52f3d"
X-SmarterMail-Spam: ISpamAssassin 0 [raw: 0], SpamAssassin -200 [raw: -100], SPF_Pass, DK_None, DKIM_Pass
X-SmarterMail-SpamDetail: Content analysis details: (-100.0 points, 5.0 required)
X-SmarterMail-SpamDetail: pts rule name description
X-SmarterMail-SpamDetail: ---- ---------------------- --------------------------------------------------
X-SmarterMail-SpamDetail: -0.0 SHORTCIRCUIT Not all rules were run, due to a shortcircuited rule
X-SmarterMail-SpamDetail: -100 USER_IN_WHITELIST From: address is in the user's white-list
X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - Contact)