Going back to mfilter.rul. Every bad guy I put in like this:

if (isin(Subject,"beauty school")) replace("subject","*","[SPAM] %1")

returns this in mfilter.log

15 11:25:15.35:4028: Unknown action () lineno=799

Apparently, it can't recognize Replace.