I've managed to get some samples of the problem messages. I had some
issues with my ISP's anti-virus on the mail server deleting the
attachments because it detected the virus 'Malformed container
violation' in the samples. But that's not why we are here.

The problem is caused by BellSouth's Anti-spam program. (surprise,
surprise)

What is happening, is that in Yahoo messages, the header as sent from
Yahoo ends:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The blank line above is critical since that it what indicates the end of
the message header and the beginning of the message body. The values
for the message id and boundary string will vary from message to
message.

After passing through the Bellsouth spam filtering, the header becomes:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
--0-2033325884-1178660436=: 23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

The 3 lines X-Spam, X-MAIL-FROM: and X-SOURCE-IP: have been added, which
in itself is OK. But the blank line has gotten lost. Another curious
change is that a space has been added in the boundary string that was
after the message id after the =: and before the ending 5 digit number.
But that doesn't seem to bother Outlook Express. I don't know if that
would bother Outlook (I've had reports that Outlook users are having the
same problem. It's not confined to Outlook Express recipients).

If the Spam filter had inserted the headers correctly, it should have
been:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-2033325884-1178660436=:23778"
Message-ID:
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]

--0-2033325884-1178660436=:23778
Content-Type: multipart/alternative;
boundary="0-2061803909-1178660436=:23778"

A workaround for Outlook Express users is to save the message to an EML
file (File, Save As), open in Notepad and insert the missing blank line
after the X-SOURCE-IP header, then save and double click the EML file to
open. It can be also dragged back to an OE folder to save and the
original message deleted.

Two things I don't know at this point:

1) If the spam headers are inserted on the Bellsouth mail servers or
some software installed on the client's PCs. I suspect it's happening
on the mail server.

2) Why messages from Yahoo are affected but not others. It may be that
the headers are inserted after the message-id or it may be that the
other mail clients don't start the body with the boundary line, but have
some unimportant text there. For example, when Outlook Express sends a
message, it ends the header with

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

In that case, if the spam filter altered the headers to

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Spam: [F=0.0001617944; S=0.010(2007050201); MH=0.500(2007050848);
R=0.015(s13/n830)]
X-MAIL-FROM:
X-SOURCE-IP: [192.168.16.123]
This is a multi-part message in MIME format.

------=_NextPart_000_0075_01C79333.5ADDF7E0

It wouldn't matter to the recipient, since the "This is a multi-part
message in MIME format." is a comment.

At this point, pressure needs to put on BellSouth by their customers to
fix their buggy spam filter.

--

Mike - http://pages.prodigy.net/michael_santovec/techhelp.htm