You can greatly simplify this by playing with the record separator. Something like the following:
#!/usr/bin/perl -w
use strict;
use Sys::Hostname qw(hostname);
use Time::HiRes qw(gettimeofday);
use Fatal qw(open close link unlink);
use constant FORWARD => 0;
use constant SUCCESS_DONTFORWARD => 99;
my $maildir = '/var/spam'; # Maildir to store spam in.
{
local $/ = "\n\n";
$_ = <>;
undef $/
my $body = <>;
}
exit !/^X-Spam-Flag:\s+YES/m
? print($_, $body), FORWARD
: do {
my $tph = join ".",
time(), "$$\_".(gettimeofday)[1], hostname();
my $temp = "$maildir/tmp/$tph";
umask 007; # Name's Bond..
{
open my $fh, ">", $temp;
print $fh $_, $body;
}
link $temp, "$maildir/new/$tph";
unlink $temp;
SUCCESS_DONTFORWARD;
};
Untested..
Makeshifts last the longest.