Store emails rejected by SpamAssassin - HEXHASH_WORD?

[jasehead]

From early this month I noticed some outbound emails (from my cubecart store) were being rejected by my host, so not reaching customers. Fortunately, only the Order Cancelled emails are the ones that were tripping SpamAssassin. The three issues (and comments from host support) were:

• HEXHASH_WORD=2.996 - this will relate to the order number format
• HTML_IMAGE_ONLY_16=1.048 - I can't see from the logs if there are HTML images included or not
• PHP_SCRIPT=2.499 - this is the method the email has been sent

I changed the store email setting from PHP mail() function to SMTP with SSL (couldn't do this originally due to other limitations), so that fixed the PHP_SCRIPT part. The spam score is now low enough to pass through, but I'd like to reduce it further to avoid future issues.

I'm expecting the HTML_IMAGE_ONLY_16 might be the store logo included in the emails? (img src etc.)

I don't understand and can not find any explanation of what HEXHASH_WORD means in the context of the Order Cancelled email. Based on the comments from support, I assumed that was the # at the start of the order number eg. #240611-192745-7425; however, the cancelled emails only use the order number without the # at all, eg.  240611-192745-7425.

Was support right about the order number format being the trigger?

What should I look for and change to reduce the HEXHASH_WORD score assigned by SpamAssassin?

[bsmither]

I have no real experience with SpamAssassin, but I would consider Support's assertion as being likely.

From what I found:
Multiple instances of word[s] + hexadecimal hash

And the actual regex that defines that, I suppose, depends on the version of Spam Assassin in use.

So, one can try rephrasing the message such that the order number is at the end of the sentence with punctuation on either side:
<p>The following order has been cancelled: {$DATA.cart_order_id}.</p>

 

Edited June 14 by bsmither