How to debug SA to identify long running body check?

Hello,

I am looking for hints how i can identify which body rule leads to 100% CPU and unusual long run time for spamassassin.

I already managed to narrow it down to malformed, "recursive-looking" mailto: URIs/anchor-tags within the body. 
The users mail client managed with each iteration of citing the previous conversation to add one more level of "recursion" to this pattern.

It looks like this in the plain text mail body:

One Person       <[email protected]<mailto:[email protected]><mailto:s=
[email protected]<mailto:[email protected]>><mailto:[email protected]=
<mailto:[email protected]><mailto:[email protected]<mailto:someone@hot=
mail.com>>><mailto:[email protected]<mailto:[email protected]><mailto:=
[email protected]<mailto:[email protected]>><mailto:[email protected]=
m<mailto:[email protected]><mailto:[email protected]<mailto:someone@ho=
tmail.com>>>><mailto:[email protected]<mailto:[email protected]><mailt=
o:[email protected]<mailto:[email protected]>><mailto:someone@hotmail.=
com<mailto:[email protected]><mailto:[email protected]<mailto:someone@=
hotmail.com>>><mailto:[email protected]<mailto:[email protected]><mail=
to:[email protected]<mailto:[email protected]>><mailto:someone@hotmail=
.com<mailto:[email protected]><mailto:[email protected]<mailto:someone=
@hotmail.com>>>>>>


This one takes about 30sec to finish. 
A block of about double this size takes already about 4min to finish.

I suspect some catastrophic backtracking is happening with such a text in the body. 
My open question is: which regex is causing this?


Best regards,
Bernhard