An attachment and subject outbreak was triggered in Symantec Mail Security for Microsoft Exchange

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Outbreak management is enabled and reports that an outbreak rule "Same Subject" is triggered. There is no evidence in the message tracking log

• Premium antispam is disabled
• Mainly event 7512 in the event log, for example:

Message arrives (original test in German), checks outbreak rules and sends an SMSMSE trigger:
 

You can receive further information at http://www.microsoft.com/contentredirect.asp."
20.12.2007 13:15:55 Symantec Mail Security for Microsoft Exchange Warning / Outbreak Management 219 on SRV05 "An outbreak condition was detected.
Outbreak Rule Information:
Outbreak Rule Name: ""Same subject""
Subject: ""RE: SALE 70% OFF on Pfizer ""
Threshold value for this rule is: 100.
Current level for this rule is: 172.

then Intelligent Message Filter (IMF) rejects/deletes message (original text in German):
 

You can receive further information at http://www.microsoft.com/contentredirect.asp."
20.12.2007 13:16:16 MSExchangeTransport Informationen SMTP-Protokoll 7512 on SRV05 "The message with ID <000801c84302$02211723$6d82b1a7@vgdsol>, P1 via smtp:[email protected], Reference: "1000EURO Welcome bonus", on remote host ""SRV05"" was rejected/deleted by Intelligent Message Filter. This event informational only and does not point to a error. 

Cause

IMF is the most likely reason that he is not seeing the mail in the message tracking log.

Resolution

Disable specific Policies > Outbreak rule(s) or change threshold

References
http://www.microsoft.com/downloads/details.aspx?familyid=B1218D8C-E8B3-48FB-9208-6F75707870C2&displaylang=en

Page 35 describes event 7512