The issue is that the detection is somewhat valid as we have script scan enabled and the post contains VB script that can be used for mass mailing.