If i receive an email with a subject like "This is your Invoice" Or "This is your Invoice John Smith"
the plugin search some of similar in the past x days and if found analyze received from
if received from are similar (server1.mservice.com, server5.mservice.com) is ok
but if server are different and subject similar it look like a virus spreaded in the word and so give score to block it
