Hi, Ian!
I had the same issue. But we digged into different way. We fight with spam as a primary target, when we got  clear email traffic to users and into helpdesk as well.
So, you shoud tuneup your antispam system on your's MX server.
THT
Cheers.

We have an antispam server which catches a tonne of SPAM, but for some reason the russian stuff is coming through as it is given a  borderline spam rating in the 30 percentiles so we can't reject it outright. It seems users complaining looks like SPAM. ;-)

We can't find a way to exclude Cyrillic emails with the Antispam vendor -direct phrase analysis isn't working in Cyrillic.The admin of the antispam server is looking into this with the vendor.

In the meantime I was hoping something could be achieved in helpdesk with the inbox filter. But this it seems doesn't match when I copy and paste Cyrillic characters into the filters.

Kind Regards,
Ian./

I've been trying queries on like:

 When ALL of these are TRUE
"Body" contains "П"
<end>

rather than,

When ALL of these are TRUE
"Body" contains "%П%"
<end>

And the same goes for the .ru match. As I was using contains operator I didn't think I needed the wild cards. I'll give this a go again.

Kind Regards,
Ian./