Are you seeing messages come through like this?
From: SBS [mailto:Administrator@contoso.com]
Sent: Tuesday, December 13, 2005 8:00 AM
Subject: WARNING(virus check bypassed): Server Performance Report – SBS
We’ve seen a few of these now – the culprit is most likely your ISP’s mail server if you are using them as a relay server (aka the “forward to host” option on your SMTP connector). Some ISP’s are proactively scanning all outbound messages through their servers. Most of the time this is OK for personal-level accounts (and you’re likely violating your ISP’s terms of service by running a business on a consumer-grade network anyway, but that’s another story), but it can obviously cause problems if you are automating the collection of reports like this.
You can confirm that the problem is your ISP in cases like this by checking the “Enable subject logging and display” on your server’s properties page in the Exchange System Manager (ESM). Message tracking will show that the mail left your server with the original subject intact.