One of my domains is being hit with the Sober worm emails (e.g., ones in German, etc. -- that I verified the subject lines on Symantec's site). I looked at the message source for a couple, and they are being sent to mailboxes@<thedomain.com> or X-User@<thedomain.com> or mailhost@<thedomain.com> or MailBox@<thedomain.com>.
SpamAssassin is not catching them because the scores are low (e.g., 1.6-3). I am trying to see if there is another way to filter since they are not addressed to actual addresses. I have the default address set to :blackhole: for this domain.
I would prefer a server-level setting, but I am open to an Outlook option. I tried to set-up an Outlook rule that only allowed emails specifically addressed to the actual email address, but I don't see a "not equal to" option.