Spam from "baosteel"

Is anyone else getting spam similar to this:
I started getting this (albeit in English) a month or two ago, and it
went away about the same time I turned on the CBL/XBL filters on
postfix. It appears it's back again.
Note, I have absolutely zero connection with "" before these
started showing up.


Common phishing scam; we see them all the time, nearly always from
accounts which have been compromised by others who respond to the same

I thought this might be the case.
Any particular hints on spam filters that can catch this type of thing?
I already have most of the Postfix Anti-UCE cheatsheet implemented, but
I'm hesitant to implement body checks because this installation supports
a very small userbase and runs on limited hardware.