Odd email issue - coincident to latest NIS update?

Presumably coincidental to NIS2010 17.5.0.127 update:  Suddenly any email containing the character sequence "MKT.F" in message body is nontransmissible.  No bounce msg received.  Nothing indicated in NIS history/quarantine.  I suspect spam interdiction while being handed off between multiple servers at ISP, though they swear no interception at send occurs.  Specific char sequence itself is the clear issue: the slightest variation including suffixing renders it transmissible.  Formatting irrelevant (HTML, RTF, ASCII).  Same content was transmissible at least 09.10.01 - 10.01.22.    Have examined logs of marginal variations of the message (thus transmissible) upon remote receipt; path is clearly home/ISP1 multiple servers/ISP2-IRONPORT/ISP2-popserver/office with no other intermediaries.  Environment:  MSOutlook2007, Vista64, NIS2010, popmail at both ends, CIcso routers & DLink switches are the only other elements in the chain. 

 

- any chance it's NIS2010 related?

- any idea why that sequence might be objectionable to, say, Ironport or Postini?

- if anyone finds the culprit obvious, pls advise!

 

thanks

 

Diatom