Controlling a message quarantine is disclosed. A message scanning method
is described in which early exit from parsing and scanning can occur by
matching threat rules only to selected message elements and stopping rule
matching as soon as a match on one message element exceeds a threat
threshold.