"handily delivered directly to your own email box." I take note of "your
own email box." So again I ask, how do you propose dealing with mail that
was "handily delivered" to your clients' email boxes. Or would you just be
assuming "if test -f LOOKS_LIKE_MY_EMAIL then filter_that".
Either way you want to cut your comment it would take a bit of snooping to
parse out traffic not destined to your own email box(es). So what do you
tell your customer "Oh by the way we had to snoop in on your sessions to
stop some new and improved MS uberworm." If so, when do you do it,
when your network is crawling, after the fact... What if you're off by one
and accidentally filter out say a contract worth a lot. Again, if I'm
missing something by all means e-smack me.