1. The first 96 bytes contains:
   * Folder description, right filled with lowecase 'a'
   * Other folder/hiearchy info
   * More lowercase 'a' to pad to the right
2. Then the format appears (to me) to be the same as Unix
3. The message termination seems to be indicated by:
   * hex OD  OA  OD  OA  1A
   *     CR  LF  CR  LF  ->
4. From '3', it is only the hex '1A' value that could indicate the msg terminator, because email bodies could have two CR/LF's anywhere.
5. I don't know if any encoding would contain hex '1A" though, so looking for the 5 character string (in hex) would be safer, plus looking at the next line (record) in the mailbox, it would be something like "X-Apparently-To: "