Block by ip address, group. There are so many faked email addresses and even content. I use a regular expression filter for entire header like this:

61.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})|62.0.8\.([0-9]{1,3})|62.39.2\.([0-9]{1,3})|62.99.([0-9]{1,3})\.|62.148.92.14[0-3]|62.149.72.6[1-3]|62.233.170.8|64.51.41.[0-3][0-9]|64.76.91.|64.202.123.199|66.178.239.98

But it gets old digging out all those Received from [IP numbers] from source view, pasting into a whois lookup to find out it is usually some radical country or same bunch of spam servers, finally adding to the fancy filter.. IP blocking is the only filter that seems to work when all else fails, especially when they fake friendly domains already on friends list.

Easily figuring out the actual sender's IP and adding to an IP blacklist can save new users the years I spent compiling a 98% successful filter list. I notice many are same IP's being reported by my website server too!

Now, if I can just figure out how to stop them emails with special characters from jamming up memory usage..