L2.APEWS.ORG False Positive #20

One of our users reported an email in the spam folder as an error, saying that it was a subscribed to newsletter about Japan tourism. Full header here;

Wed 2013-06-19 04:27:06: [4181:459] Accepting SMTP connection from [203.191.244.137]
Wed 2013-06-19 04:27:06: [4181:459] Looking up PTR record for 203.191.244.137 (137.244.191.203.IN-ADDR.ARPA)
Wed 2013-06-19 04:27:06: [4181:459] D=137.128-26.244.191.203.IN-ADDR.ARPA TTL=(59) PTR=[mail3-5.webcas.net]
Wed 2013-06-19 04:27:06: [4181:459] Gathering A-records for PTR hosts
Wed 2013-06-19 04:27:06: [4181:459] D=mail3-5.webcas.net TTL=(60) A=[203.191.244.137]
Wed 2013-06-19 04:27:06: [4181:459] --> 220-ns7.methusalah.com ESMTP MDaemon 6.7.9; Wed, 19 Jun 2013 04:27:06 -0500
Wed 2013-06-19 04:27:06: [4181:459] -->
Wed 2013-06-19 04:27:07: [4181:459] <-- EHLO wcasp3-efmta2.webcas.net
Wed 2013-06-19 04:27:07: [4181:459] Performing reverse lookup on wcasp3-efmta2.webcas.net (looking for 203.191.244.137)
Wed 2013-06-19 04:27:07: [4181:459] Name server reports domain name unknown.
Wed 2013-06-19 04:27:07: [4181:459] --> 250-ns7.methusalah.com Hello mail3-5.webcas.net (may be forged), pleased to meet you
Wed 2013-06-19 04:27:07: [4181:459] --> 250-ETRN
Wed 2013-06-19 04:27:07: [4181:459] --> 250-AUTH=LOGIN
Wed 2013-06-19 04:27:07: [4181:459] --> 250-AUTH LOGIN CRAM-MD5
Wed 2013-06-19 04:27:07: [4181:459] --> 250-8BITMIME
Wed 2013-06-19 04:27:07: [4181:459] --> 250 SIZE 0
Wed 2013-06-19 04:27:07: [4181:459] <-- MAIL FROM:<errmailxxx @ mail3.webcas.net> SIZE=11707
Wed 2013-06-19 04:27:07: [4181:459] Performing reverse lookup on mail3.webcas.net (looking for 203.191.244.137)
Wed 2013-06-19 04:27:07: [4181:459] D=mail3.webcas.net TTL=(60) A=[203.191.244.132]
Wed 2013-06-19 04:27:08: [4181:459] P=010 D=mail3.webcas.net TTL=(60) MX=[mail3.webcas.net] {203.191.244.132}
Wed 2013-06-19 04:27:08: [4181:459] Spam Blocker A-record resolution of [137.244.191.203.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.3)...
Wed 2013-06-19 04:27:08: [4181:459] L2.APEWS.ORG LISTED
Wed 2013-06-19 04:27:08: [4181:459] Message will be accepted and X-RBL-Warning: header will be inserted.
Wed 2013-06-19 04:27:08: [4181:459] --> 250 <errmailxxx @ mail3.webcas.net>, Sender ok
Wed 2013-06-19 04:27:08: [4181:459] <-- RCPT TO:<xxx@xxx.xxx>
Wed 2013-06-19 04:27:08: [4181:459] --> 250 <xxx@xxx.xxx>, Recipient ok
Wed 2013-06-19 04:27:08: [4181:459] <-- DATA
Wed 2013-06-19 04:27:08: [4181:459] --> 354 Enter mail, end with <CRLF>.<CRLF>
Wed 2013-06-19 04:27:09: [4181:459] --> 250 Ok, message saved <Message-ID: xxx.newsletter @ japantravelinfo.com>
Wed 2013-06-19 04:27:09: [4181:459] <-- QUIT
Wed 2013-06-19 04:27:09: [4181:459] --> 221 See ya in cyberspace
Wed 2013-06-19 04:27:09: [4181:459] SMTP session successful, 11682 bytes transferred.
Wed 2013-06-19 04:27:09: [4181:459] Shuffling message(s) into proper queue(s)
Wed 2013-06-19 04:27:09: [4181:459] Message received from wcasp3-efmta2.webcas.net [203.191.244.137] <errmail4-03@mail3.webcas.net> with SMTP for <xxx@xxx.xxx> [Size 11671] {j:\localq\7000002893.msg}