Late to the party here but if you scroll through the source of these messages, there are a few domains they use to host the "image" inside the message. Addition

Late to the party here but if you scroll through the source of these messages, there are a few domains they use to host the "image" inside the message. Additionally some of the spammers try and use the "coord" HTML element to put links on their images. If you create a filter to immediately delete the messages with "coord" in the source and these image domains you should be decently covered: iili.io, caringbridge.org, mailingghost.store If anyone is interested in working towards root cause on this please let me know.