Problem with sieve not triggering randomly?

[Chris Adams]

I'm running CentOS 7.1 with Dovecot 2.2.10 (CentOS packaged version).  I
have Postfix feeding messages to Dovecot for local delivery via LMTP,
and I have Amavisd for spam filtering.  For messages above a certain
threshold, Amavisd adds the "X-Spam-Flag: YES" header, and I file that
into the Spam folder using a default (system-wide) sieve script (there
aren't any per-user sieve scripts set up):

require "fileinto";
if header :contains "X-Spam-Flag" "YES" {
	fileinto "Spam";
}

I can see it work on my test messages and from lmtp log entries.

However, it doesn't seem to always work.  I had a user complain about a
spam increase, and I looked in their mailbox.  I see a message with the
"X-Spam-Flag: YES" header, but it is in the INBOX (and the corresponding
lmtp log entry shows that's where it went).

Why would the sieve script work on some messages and not others?  I
don't see any errors in the log.  I see a bunch of messages from the
same source to different users, and they were all filed into INBOX, not
Spam.

Looking at the message in question, it is a pretty bogus message.  There
are multiple From: and Subject: headers.  Would that cause sieve to
"punt" on the message (but not log anything about it)?

-- 
Chris Adams <cma at cmadams.net>