I've found that one amazing category of spam that gets through my filters these days have Google Groups headers for lists that have a two- to three-letter first part of the mailing list address. So it'll be like ho.dsafjkdsaf.euw77 at groups.google.com or something. So that's a heuristic now, at least?