The new cloudmark antispam engine detects many good emails as spam.
Is the same thing happening to you?
Yep. The old one did too, but it generally marked them as "suspect" so it was a little easier to manage. I would send the messages marked "Spam" directly to the users' junk folder and kept the "suspect" in their inbox for them to manage.
I don't think that there is a perfect solution to this problem and the further away your are from the USA the bigger the problem. There really needs to be an easier way (i.e. from within a mail client) to report false positives and false negatives.
Adrian from Australia
The issue with reporting from a mail client is that it's pretty easy to make a macro to utilize a button for this -- it's just that installing said button is problematic due to how much MS office macros are abused by malware, etc.
If this is helpful, it does basically what you're looking for:https://stackoverflow.com/questions/14589250/forward-current-message-as-attachment-then-delete-original-message
WatchGuard Customer Support