Anyone using DCC to block spam? How to config Gnus based on X-DCC-* ?

[Chris Shenton <chris@shenton.org>]

I recently started trying to use DCC (Distributed Checksum
Clearinghouse, http://www.rhyolite.com/anti-spam/dcc/) to block spam. 
I've configged my MTA to pass my mail through the "dccproc" which adds
a header to the mail based on the counts of potential spam the
clearinghouse has seen.  Seems to be working well, some obvious spam
showed up today with this DCC header: 

  X-DCC-Etherboy-Metrics: thanatos.shenton.org 1002; env_From=1 From=1
	Subject=1 Message-ID=1 Received=1 Body=many Fuz1=many

indicating the same body was received by "many" DCC users, though the
From, Subject, and Message-ID were all different. Another DCC header:

  X-DCC-wanadoo-be-Metrics: thanatos.shenton.org 1016; env_From=1 From=1
	Subject=many Message-ID=1 Received=1 Body=many Fuz1=many

indicates less clever spam with the exact same Subject, as well as
Body.


So my question is how can I get Gnus to nuke or filter based on this
line? I realize I could do something like:

(setq nnmail-split-methods
      '(
	("in.spam"		"^X-DCC-.*Body=many")
        ...))

But seems that more complicated decisions would require truly hairy
regexps. 

More immediately is how to examine the entire header, even though it
runs across multiple lines.  Or is Gnus smart enough to grab the
entire header somewhere I can play with it? 

Any suggestions? 

Thanks.