PDF Spam. Add ".pdf" to your Subject filter. Legit email will rarely have .pdf in the subject. Now, if someone does a rightclick/send email on a PDF it does default to a subject of emailing xxx.pdf. So ymmv. I use Ironmail to filter spam for my company and found that by adding some points for .pdf subject I could push most of the spam over the threshold without getting too many false positives. ymmv.