Forwarding copy of SPAM-tagged subjects to my mailbox?

Question

Our ISP was starting to tag some of our mails with the addition [SPAM] in the subject.
How can I forward a copy of every incoming mail with such a text in the subject to a internal spam-mailbox for further checks?
Can I use some kind of regular expression for the search of "SPAM" in the subject?
If our C100 doesn't detect such a mail as spam, how can I remove the added tag from the ISP?
(Some of our employees are a little bit confused about this and ask for the appropriate handling of such mails).

Answer 1

Yes, you can generally put in an incoming content filter that will search for something like this:
if ( subject == "^[SPAM]" )
then
alt-mailhost('alternate_location');
or
bcc-scan('[email protected]')
The Advanced User guide found on the Support Portal will explain these actions in further detail.
However, we need to verify what Sendergroup/Mail Flow Policy the ISP is matching on. This makes a difference because we need to know if this connection is occurring on the inbound(Accepted, Throttled mail flow policy) or on the outbound (Relayed).
Is the ISP on a Relaylist? (Mail Policies > HAT Overview)
Once we have more information, we can provide a more specific answer.
Our ISP was starting to tag some of our mails with the addition [SPAM] in the subject.
How can I forward a copy of every incoming mail with such a text in the subject to a internal spam-mailbox for further checks?
Can I use some kind of regular expression for the search of "SPAM" in the subject?
If our C100 doesn't detect such a mail as spam, how can I remove the added tag from the ISP?
(Some of our employees are a little bit confused about this and ask for the appropriate handling of such mails).