Examppe header:

Return-Path: <gstpicx@citylinq.com>
Received: from 216-199-140-34.ftl.fdn.com (216-199-140-34.ftl.fdn.com 
[216.199.140.34] (may be forged))
     by mail.prospeed.net (8.13.0/8.13.0) with SMTP id iB3JIalm022224;
     Fri, 3 Dec 2004 14:19:28 -0500
Date: Fri, 3 Dec 2004 14:19:28 -0500
From: gstpicx@citylinq.com
Message-Id: <200412031919.iB3JIalm022224@mail.prospeed.net>
Received: from alan.msn.com ([48.3.184.202]) by domesday.msn.com
     (InterMail vK.4.04.00.07 315-698-423-60184047 license 
5uu026cm9483k7lk8x4zsc9247j0fvi6)
     with ESMTP id <33242145269306.SRBS096.inhibit@williamson.msn.com>
     for <sbrady@prospeed.net>; Fri, 03 Dec 2004 13:13:50 -0600
Received: from core.juno.com ([0.231.116.232])
     by methuen.juno.com
     (Sun Java System Messaging Server 6.1 HotFix 0.01 (built Jun 23 2004))
     with ESMTP id <0I4I00HS13H8UN01@gaudy.juno.com> for sbrady@prospeed.net
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on ntop.prospeed.net
X-Spam-Level: *********************************
X-Spam-Status: Yes, score=33.2 required=4.0 tests=BAYES_99,BIZ_TLD,
     FAKE_HELO_MSN,HELO_DYNAMIC_IPADDR2,MISSING_HEADERS,MISSING_SUBJECT,
     MSGID_FROM_MTA_HEADER,MSGID_FROM_MTA_ID,NO_RDNS_DOTCOM_HELO,
     NO_REAL_NAME,RCVD_ILLEGAL_IP,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,
     RCVD_IN_XBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL,
     URI_OFFERS autolearn=spam version=3.0.1
X-Spam-Report: 
     * 0.0 NO_REAL_NAME From: does not include a real name
     * 3.5 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 
2)
     * 2.6 FAKE_HELO_MSN Host HELO did not match rDNS: msn.com
     * 0.0 NO_RDNS_DOTCOM_HELO Host HELO'd as a big ISP, but had no rDNS
     * 1.7 MSGID_FROM_MTA_ID Message-Id for external message added locally
     * 0.9 RCVD_ILLEGAL_IP Received: contains illegal IP address
     * 0.1 MISSING_HEADERS Missing To: header
     * 2.3 BIZ_TLD URI: Contains an URL in the BIZ top-level domain
     * 0.8 URI_OFFERS URI: Message has link to company offers
     * 1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
     * [score: 1.0000]
     * 3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
     * [<http://dsbl.org/listing?216.199.140.34>]
     * 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
     * [Blocked - see <http://www.spamcop.net/bl.shtml?216.199.140.34>]
     * 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
     * [216.199.140.34 listed in sbl-xbl.spamhaus.org]
     * 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
     * [URIs: royaloffer.biz]
     * 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
     * [URIs: royaloffer.biz]
     * 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
     * [URIs: royaloffer.biz]
     * 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
     * [URIs: royaloffer.biz]
     * 1.2 MISSING_SUBJECT Missing Subject: header
     * 0.1 MSGID_FROM_MTA_HEADER Message-Id was added by a relay

My configuration: 

required_hits 4
whitelist_from data@inboundms.com
whitelist_from bb@mandrake.prospeed.net
rewrite_header Subject *****SPAM*****
report_safe 0
bayes_path /var/spool/spamassassin/bayes
bayes_file_mode 0775