> MITM
> или
> service in the middle

В качестве service может выступать антивирус провайдера (Касперский).

Письмо с winmail.dat:

X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: ...
acceptlanguage: ru-RU, en-US
MIME-Version: 1.0
X-TM-AS-Product-Ver: SMEX-8.0.0.1307-6.800.1017-20060.002
X-TM-AS-Result: No--1.666100-4.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-KLMS-Rule-ID: 1
X-KLMS-Message-Action: clean
X-KLMS-AntiSpam-Lua-Profiles: 50753 [Sep 19 2013]
X-KLMS-AntiSpam-Version: 5.3.2
X-KLMS-AntiSpam-Envelope-From: sender_email@sender-domain.com
X-KLMS-AntiSpam-Rate: 0
X-KLMS-AntiSpam-Status: not_detected
X-KLMS-AntiSpam-Method: none
X-KLMS-AntiSpam-Moebius-Timestamps: 2565101, 2565142, 2565138
X-KLMS-AntiSpam-Interceptor-Info: scan successful
X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server 8.0.0.455, bases: 2013/09/19 03:29:00 #11091152; khse: 2013-04-03 08:48:01
X-KLMS-AntiVirus-Status: Clean, skipped

Нормальное письмо:
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
acceptlanguage: ru-RU, en-US
Content-Type: multipart/mixed;
        boundary="_004_.....;
MIME-Version: 1.0
X-TM-AS-Product-Ver: SMEX-8.0.0.1307-6.800.1017-20060.002
X-TM-AS-Result: No--10.819200-4.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-KLMS-Rule-ID: 1
X-KLMS-Message-Action: clean
X-KLMS-AntiSpam-Lua-Profiles: 50753 [Sep 19 2013]
X-KLMS-AntiSpam-Version: 5.3.2
X-KLMS-AntiSpam-Envelope-From: sender_email@sender-domain.com
X-KLMS-AntiSpam-Rate: 0
X-KLMS-AntiSpam-Status: not_detected
X-KLMS-AntiSpam-Method: none
X-KLMS-AntiSpam-Moebius-Timestamps: 2565101, 2565142, 2565138
X-KLMS-AntiSpam-Interceptor-Info: scan successful
X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server 8.0.0.455, bases: 2013/09/19 03:29:00 #11091152; khse: 2013-04-03 08:48:01
X-KLMS-AntiVirus-Status: Clean, skipped

Отличаются X-TM-AS-Result (вроде бы к Касперу не относятся). К чему относятся, пока не понял. Заголовки Касперского одинаковые.