As mentioned in T170601#4023723 I get lots of spam targeting cep-owner@. Those messages match the two conditions for ref3 at https://phabricator.wikimedia.org/source/operations-puppet/browse/production/modules/profile/templates/exim/system_filter.conf.mailman.erb;555070812a85ab8e51bd88bc35ecebaa24e50bdf$31 so that does not seem to work (anymore)?
ref2 nearly also matches. It would match if it was .*8。C(O|0)M.* instead.
Edit: Nope, many but not _all_ emails include that. Same for .*5⒏0提.*.