>  Strange as it may seem the spam that I'm trying to catch always comes in
as
>  To: Joe Blow <real@[...].com>

Late on chiming in on this, but I would write a rule for that specific
address (only) as

header JOEBLOW    ToCc =~ /^\s*Joe\sBlow\s{0,5}<real\@example\.com> /i

If (from what I recall of your original rule) "joe blow" is really a
nmemonic for any two-word name, and it always contains alphas, and they
always have initial caps, I would write:

header JOEBLOW ToCc =~
/^\s*[A-Z]\w+\s{1,5}[A-Z]\w+\s{0,5}<\w+\@\w+\.(?i:com|net|biz|info)> /    #
no /i

Or something close along those lines.

        Loren