Google Message Security for Google Apps Administration Guide - Manual (Page 393)

Customizing Notifications 393
where the URL is the location of the Widget for your organization.)
My First Spam Notification
Users receive this message when they receive their first junk mail.
The “From:”, “To:” & “Subject:” lines must be at the top of a custom notification,
since they are used as the actual message headers for the message when sent
out. If they are not included, then the custom notification messages will bounce.
The tokens available for the My First Spam notification:
<-date->
The timestamp indicating the date and time the notification was sent.
<-from->