Google Message Security for Google Apps Administration Guide - Manual (Page 405)

Interpreting Header Fields 405
The first number is the user's Bulk Filter (base) spam setting:
• 1= lenient
• 2= less lenient
• 3= moderate
• 4= more aggressive
• 5= most aggressive
In the example above, the user's bulk filter was set to 5, the most aggressive
setting.
The parenthesized pair of numbers indicate the user's base threshold and
effective threshold. These are derived values and should not be directly
interpreted, as they are subject to change.
If any C, M, P, or R filter that the user turned on has a value less than 85, the
effective threshold value is a multiple of the base threshold value. If none of these
filters is less than 85, the threshold value is the same as the base value.
The final letters on the line indicate which filters the user had turned on and which
had values less than 85 (these are in upper case). In the above example, the
make-money-fast (M) and the commercial offer (C) category filters were triggered.
If a category filter is turned off, the letter representing it does not appear on this
line.
You may also see the letters CV in the X-pstn-settings field. This indicates
suspicious (but uncertain) virus-like message content. If the message is otherwise
normal, this does not necessarily stop the message.
Determining Whether or Not the Message is Spam
The final step in determining whether an email is quarantined or not is to compare
the spam score against the threshold value.
If the spam score is less than the effective threshold, the email is considered
spam. If it is greater than or equal to the effective threshold, the email is sent to
the recipient's inbox.
Example:
X-pstn-levels: (S: 0.00000/60.95723 R:95.91080 P:95.91081
M:64.93900 C:93.23770 )
X-pstn-settings: 5 (2.00000:8.00000) r p M C
In this example, the spam score is 0.00000 and the effective threshold is 8.00000.
Since 0.00000 is less than 8.00000, this message is spam.