had some spam recently with things like
To: Mary Poppins <joan@example.com>

the following tries to tag that, assuming that there was an entry like
"Joan Higgins" in GECOS and not "Higgins - Joan"

sub check_realname {
                                                                               
                                         
# Andrew Daviel, TRIUMF, Nov 2006
# add to site_perl/xxx/Mail/SpamAssassin/EvalTests.pm
                                                                               
                                         
# header NOTGECOS  eval:check_realname('to')
# describe NOTGECOS Real name in To does not match GECOS
                                                                               
                                         
# header NOTGECOSCC  eval:check_realname('cc')
# describe NOTGECOSCC Real name in Cc does not match GECOS
                                                                               
                                         
  my ($self, $dest) = @_;
  my $lastname ;
  my $notreal = 0 ;
                                                                               
                                         
  my $to = $self->get('To') ;
  my $cc =  $self->get('Cc') ;
  my ($user,$passwd,$uid,$gid, $quota,$comment,$gcos,$dir,$shell,$expire) =
getpwuid($>) ;
  my ($cn,$room,$tel) = split(/,/,$gcos) ;
  if ($cn =~ /[\s](.*)$/) { $lastname = $1 ; }
  if (defined($lastname)) {
    if ($dest eq 'to' and $to =~ /(?<!$lastname)"{0,1} <$user/) {
      $notreal = 1 ;
    }
    if ($dest eq 'cc' and $cc =~ /(?<!$lastname)"{0,1} <$user/) {
      $notreal = 1 ;
    }
  }
  return $notreal ;
}
                                                                               
                                         
1;