You need something after the From: and before the spammers email address.

inside the square brackets you want a space followed by a tab. (I couldn't type a tab here.)

That will only match [email protected] and won't inadvertently match similar email addresses that end with the same string like [email protected]

the space tab inside the square brackets followed by the asterisk matches white space, so the expression matches "From:" at the beginning of the line, followed by zero or more white space characters, followed by [email protected]

You could use .* instead of the white space expression but that could produce some extra matches.

Anyway, try that, see if it works.

-David