Consider performing a
SpamAssassin Rule: RCVD_IN_MAPS_RBL
Standard description: Relay in RBL, www.mail-abuse.org/rbl/
Explanation
The message was received via a relay listed in the DNSBL blackholes.mail-abuse.org.
The criteria for listing is that the relay address may be a multi-hop (multiple IP) open relay, a spam source, or a spam support service
Since 2005, mail-abuse.org is operated by Trend Micro
Further Info
The default scores for this rule can be found in the online list of tests.