In reply to Richard Staynings.

Placing filters that compare Friendly From and Mail From fields can lead to false positives. There are examples of ligitimate mail where these are different; a bounce message, a healthcare provider or 401K provider that sends mail internally and uses the companies mail domain.