When you have configured your Exim filter with contains, some emails are being filtered correctly. However, other emails are being filtered despite not having the keywords in the email.
This occurs because of the way that Exim filters work. When you're using
contains, it will search for the keywords that you have configured in the message. However, it will not search only for whole words, but for the word within words.
For example, you have configured an Exim filter that triggers if the message contains BTC in the body. If you attach a PDF document to your email, it will be encoded in base64. While the message does not even mention BTC, the message triggered the Exim filter. This occurs because within the encoded base64 PDF attachment we can observe the following:
Above is a part of the encoded base64 PDF attachment. In this part of the attachment we can observe, that contains BTC:
As mention previously, Exim Filter will not only search for whole words but also the word surrounded by other characters as well. It's not necessarily that the message contains the word BTC, but the encoding of the message or attachment does.
Instead of using
contains use RegEx as with RegEx you can specify a specific pattern to search for.