Martin,

Are you running the latest version?  Note the release notes:
// New to VersionNumber = '3.0.1.572';
{TODO -cFix : Memory leak of about 400 bytes for every email that was forwarded}

// New to VersionNumber = '3.0.1.571';
{TODO -cFix : Redesigned how emails are added to quarantine DB - now this is handled by a separate thread, eliminating issues where MySQL database locks caused connections to queue up}
{TODO -cNew : logging for quarantined events has changed as follows:}
{ the entry "EMail from a@a.com to b@b.com was received and quarantined" has a different threadID than the thread that processes the connection }
{ added log entry "Created thread (nnnnn) to add email to quarantine" to track which quarantine thread was created in the connection thread}
{TODO -cFix : To attempt avoiding "Read Timeout" server errors when forwarding emails, we attempt to transfer emails in memory to the delivery thread, in addition to using queue spool files as a backup method}
{ -NOTE- this will prevent antiviruses that scan the FileSystem to detect and stop emails}
{TODO -cNew : Added SpoolQueueFilesToMemory SpamFilter.ini option to force emails to be spooled to disk}
{TODO -cNew : Added SpamFilter.ini option to scan multiple images for spam}
{TODO -cNew : The whitelist keyword filter now scans thru all the email's headers}

thanks, we'll just switch the option off for now.

can't see us catching that much on scanning the headers, especially if its causing false positives like this.