They're all coming in from email addresses like 396960395@qq.com (i.e., domain is the same, the numeric email account changes). Header info follows:
```
Delivered-To: risker.wp@gmail.com
Received: by 10.83.42.65 with SMTP id q62csp2462689yxq;
Thu, 13 Jul 2017 09:13:39 -0700 (PDT)
X-Received: by 10.55.65.22 with SMTP id o22mr5463694qka.213.1499962419580;
Thu, 13 Jul 2017 09:13:39 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1499962419; cv=none;
d=google.com; s=arc-20160816;
b=fDQMsD5JS/cd8gi/Ed+lDHMOz1ugi3JgkFdeTEAGwKC79hEUrKO7l4fRMBywtNBrCQ
HeJqkJVltuQmrjk7h0gReA6IlwS63kr4ZRPFiURHgqMiamWgOwODJRKL8/GSUEkgWrtk
OVUx/O8QSQtIWAj74GeMv1OWR1LvIaSltr6yAKG0zTOkuzwt/xZhYN26SEL2BRa4rz70
VR8Bheojcsx1tCRxSUyS4zqcPTeiN5g6cz22vPRlbBP6fuMrc3ZmOxgC0bkNT6wLTouA
3HJgdHoZWnSO7JHnQUiHf5CArHSVy2HxJvt57nc7Crd0AiB+/9Uh9ycnUjUeKeO5IuIJ
P5rw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=sender:errors-to:from:to:subject:message-id:date:mime-version
:dkim-signature:arc-authentication-results;
bh=/E7avsRBSAWVcp2hQFRchBT/Jgzf7VfHLsoVX3rfUKU=;
b=VqK+lBwvP6e65nRYQDA1KB7P/H65C00OVPTmcEcJj4eDtMEyHYrPCiQdjf7ZJP4GMf
zTNG8HwfmrG8yythGsnacApM2EHtS2F4YxmqmyrYsLjZR7uCQXMh84t/Jt9ml3wGGuQx
m1PrwkiR88f2dnhSYzFNJ6P99+y3M0Dh7g8Fmsds97lBdgTxlQ034TFgm26utK0zwPN6
lslv1VL1dgCALaKy1DyVtDXyiMk2020YN5tByTOIUBwR03jaebGAvuD+mnVA1LV927J7
uGsteCfAAcMfM2qmcHTyvBy7XPP8EhGLA77xhZhJtvamiJ6QeVBcNEN5Q+K0SnV5JPx8
AeFw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@lists.wikimedia.org header.b=sQToPzEZ;
spf=pass (google.com: domain of mailman-bounces@lists.wikimedia.org designates 208.80.154.21 as permitted sender) smtp.mailfrom=mailman-bounces@lists.wikimedia.org;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=qq.com
Return-Path: <mailman-bounces@lists.wikimedia.org>
Received: from lists.wikimedia.org (lists.wikimedia.org. [208.80.154.21])
by mx.google.com with ESMTPS id q67si5555342qki.120.2017.07.13.09.13.39
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 13 Jul 2017 09:13:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of mailman-bounces@lists.wikimedia.org designates 208.80.154.21 as permitted sender) client-ip=208.80.154.21;
Authentication-Results: mx.google.com;
dkim=pass header.i=@lists.wikimedia.org header.b=sQToPzEZ;
spf=pass (google.com: domain of mailman-bounces@lists.wikimedia.org designates 208.80.154.21 as permitted sender) smtp.mailfrom=mailman-bounces@lists.wikimedia.org;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=qq.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.wikimedia.org; s=wikimedia; h=Sender:Content-Type:From:To:Subject:Message-ID:Date:MIME-Version; bh=/E7avsRBSAWVcp2hQFRchBT/Jgzf7VfHLsoVX3rfUKU=; b=sQToPzEZv8oZ2GYr8kwRuX77xqXtSouEpQRzYTYFzNjRkuSqdF+cJ/LuKQ7HzJrKFI0aIA021Foo3IsDOI52uTV5q7+tuzRCgx2U4iOtPoLBPL0wFXLj0TCCnFDmAAPifxvKgp/8JG2bhFDnSYx15RvvnEylCVhizhbusbo5p3A=;
Received: from localhost ([::1]:46820 helo=fermium.wikimedia.org) by fermium.wikimedia.org with esmtp (Exim 4.84_2) (envelope-from <mailman-bounces@lists.wikimedia.org>) id 1dVgkE-00075e-Sg; Thu, 13 Jul 2017 16:13:39 +0000
Received: from [218.90.80.50] (port=58475 helo=helichina.com) by fermium.wikimedia.org with esmtp (Exim 4.84_2) (envelope-from <799808248@qq.com>) id 1dVgkC-00074s-9O for checkuser-l-owner@lists.wikimedia.org; Thu, 13 Jul 2017 16:13:37 +0000
MIME-Version: 1.0
Date: Fri, 14 Jul 2017 00:13:30 +0800
Message-ID: <8b0c233a717b3af2@bed15bbada91ee95>
Subject: 葛娜求-墺門永利331458。COM邀您住冊嶺5⒏赢58O提现, Jia客服扣:295019338瓴，只要投紸红宝天天抢，下鉒6和就送$特马最高51.8倍出口服务器过密
To: checkuser-l-owner@lists.wikimedia.org
Received: from helichina.com (unknown (53.78.60.206]) by helichina.com with SMTP id df0bed33-b417-4933-914b-b4fbd97df05a; for <checkuser-l-owner@lists.wikimedia.org>;Fri, 14 Jul 2017 00:13:30 +08:00
From: "关安" <799808248@qq.com>
Content-Type: multipart/alternative; boundary="074fd469-d9b2-484b-8eec-76dcf4541374"
Errors-To: mailman-bounces@lists.wikimedia.org
Sender: CheckUser-l <mailman-bounces@lists.wikimedia.org>
X-Spam-Score: 7.6 (+++++++)
X-Spam-Report: Spam detection software, running on the system "fermium.wikimedia.org", has identified this incoming email as possible spam.
The original message has been attached to this so you can view it or label similar future email.
If you have any questions, see the administrator of that system for details.
Content preview:
幻苍崖云æ ‘ 诗道有法，昔人贵在妙悟。……如禅门之作三观，如玄门之炼九还，观熟斯现心�
， 李佳顺lijiashun [...]
Content analysis details:
(7.6 points, 4.0 required)
pts rule name
description ---- ---------------------- --------------------------------------------------
0.0 BAD_ENC_HEADER
Message has bad MIME encoding in the header
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (799808248[at]qq.com)
0.0 FREEMAIL_FROM
Sender email is commonly abused enduser mail provider
(799808248[at]qq.com)
0.7 MPART_ALT_DIFF
BODY: HTML and text parts are different
0.0 HTML_MESSAGE
BODY: HTML included in message
1.1 MIME_HTML_ONLY
BODY: Message only has text/html MIME parts
0.0 RCVD_IN_SORBS_DUL
RBL: SORBS: sent directly from dynamic IP address
[218.90.80.50 listed in dnsbl.sorbs.net]
3.6 RCVD_IN_PBL
RBL: Received via a relay in Spamhaus PBL
[218.90.80.50 listed in zen.spamhaus.org]
0.0 UNPARSEABLE_RELAY
Informational: message has unparseable relay lines
0.0 MIME_HTML_ONLY_MULTI
Multipart message only has text/html MIME parts
0.6 HTML_MIME_NO_HTML_TAG
HTML-only message, but there is no HTML tag
0.0 MSGID_FROM_MTA_HEADER
Message-Id was added by a relay
1.3 RDNS_NONE
Delivered to internal network by a host with no rDNS
```