Spam: Personalized subject and greetings via Salesforce Marketing Cloud

type.inbound
// attempt to find SF sending infra 
and (
  headers.domains[0].root_domain == "exacttarget.com"
  or strings.iends_with(headers.message_id, '.xt.local>')
  or any(headers.hops,
         any(.fields,
             .name =~ "X-SFMC-Stack"
             or (.name =~ "x-job" and regex.match(.value, '^\d+_\d+$'))
         )
  )
)
// the message contains a fake previous thread
and length(body.previous_threads) == 1

// extract the name from the subject
and any(regex.iextract(subject.base, '(?:^|: )(?P<first_name>[A-Z][a-z]+)$'),
        // the current thread starts with "Hi <extracted from subject>
        strings.istarts_with(body.current_thread.text,
                             strings.concat('Hi ', .named_groups["first_name"])
        )
        // the previous thread starts with "Hi <extracted from subject>
        and any(body.previous_threads,
                strings.istarts_with(.text,
                                     strings.concat('Hi ',
                                                    ..named_groups["first_name"]
                                     )
                )
        )
)