header lines being folded into one?

I've got a rule for spotting a dodgy X-Originating-IP:

header PJ_BOGUS_XORIGIN X-Originating-IP =~ /\.([3-9][^. ][^. ]+|2[6-9][^. ]+|25[6-9][^. ]*)\./

I was investigating an unusual hit, when I noticed the following:

It will produce a positive hit when an email contains two lines like these:

X-Originating-IP: [17.148.16.66]
X-Originating-IP: 134.32.140.207

whereas there is no match if the email only contains one of those. (either one)

It looks to me like the two X-Originating-IP lines are merged into one, and my regex is then applied to:

X-Originating-IP: [17.148.16.66]134.32.140.207

Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related spamassassin.apache.org Links users Request more information about Pantek

Is this normal/correct behaviour?

/Per Jessen, Zürich Received on Tue Oct 9 06:59:41 2007