BAYES_99 & BAYES_999 Issue with email with no body but attachments

Hello, Our user A from Server A has emailed our user B on Server B, and that email was flagged as spam and ended up in Junk folder. Reason you may ask? X-Source:=20 X-Source-Args:=20 X-Source-Dir:=20 X-Spam-Status: Yes, score=3D10.2 X-Spam-Score: 102 X-Spam-Bar: ++++++++++ X-Spam-Report: Spam detection software, running on the system = "OUR_SERVER", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: =20 Content analysis details: (10.2 points, 10.0 required) pts rule name description ---- ---------------------- = -------------------------------------------------- 5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.0000] 1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to = 100% [score: 1.0000] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL = was blocked. See = Welcome to Pyzor"s documentation! " Pyzor 1.0 documentation) 0.0 TVD_SPACE_RATIO No description available. 2.2 SB_GIF_AND_NO_URIS No description available. 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with = Strict Alignment 0.1 DKIM_INVALID DKIM or DK signature exists, but is not = valid 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe X-Spam-Flag: YES Subject: ***SPAM*** EMAIL_SUBJECT This is a multipart message in MIME format.
By the looks of things, the email has no body content, but just legitimate attachments that the user chose to send to the other user. In my mind, this is a legit use of emailing... But clearly not according to SpamAssassin... 1) How do you guys get around this other than actually going and changing the score either user-specific or server-wide? 2) Can someone explain why PYZOR_CHECK is unhappy and scording 1.8 there? 3) What's the difference between BAYES_99 and BAYES_999 and what exactly don't they like? 4) SB_GIF_AND_NO_URIS: That's just in almost everyone's email signature isn't it? An image that is their company logo or similar why is this an issue? :facepalm: