Is this inbound or outbound traffic? It's been 10+ years since I've worked with a Barracuda cluster.

Either way, you'd think that since it's a spam appliance, it would by default be able to identify this blatant spam.

Can you show an example email, and in which direction its traveling? There may be better approaches than regex. Using regex for filtering can have serious accidental consequences (from my experience).