we getting a lot of financial spam advertisements that have "Form" field other that "Header From" please take a look my Antispam Profile setttings:
Log when these emails are coming to Fortimail:
And how it looks at the employees Outlook:
Fortimail should at first step recognize these messages as Spam so should move it to personal quarantine folder - but doesn't.
Or it should tag these emails as [Suspicious Email] because of SFP Alignment Sender mismatch - but also doesn't.
I created a ticket at support they recommend me to upgrade Fortimail firmware, so I did to latest 6.4.5GA - but this didn't help.