The latest is that my ISP seems to relay a very few messages internally such that my ISP's ip address is the most recent in the e-mail header. This has caused a few non-spam messages to be trapped by the ip address filter when they were not actually spam.
Since my position is that false positives should not be tolerated, not even one, and it has happened at least twice, I am disabling the ip address filter. Ip address filtering might still work for you but my ISP has recently changed something that makes it unreliable for me.
I recently implemented a new filter for specific subject text. I did this to trap the high number of e-mails with pdf attachments, usually stock tips. The file extension filter didn't seem to be able to stop them. Filtering using a text file containing text from subject lines has work well, at least for now (until they read this).
In the last four days the subject filter has trapped 46 e-mails out of 422 (all spam) while the spam address filter only caught 17. The SpamEntire filter caught 157 so losing the ip address filter will not result in too many additional messages getting through. A little more diligence with the other filters will probably make up the difference.
Scott