No,

  SFI can not scan headers, only the received.

I feel that SA behind SFI is a better choice. SA is compute intensive so we let SFI handle majority of the dirty work because it is fast and handles things like maps and surbl well and has that wonderful black list cache. If it makes it thru the SFI gauntlet we then apply SA and get that last bit that SFI misses. In SA we have it add '|spam|' to the subject of high scoring emails and then send it to a second instance of SFI that has all filters disabled except the Subject:|spam| blacklist keyword. Doing this last part gets it into the quarantine db so our customers can retrieve it if they want and we don't have to mess with it.