I've noticed that mails with a deny-matching header (e.g. the popular To: undisclosed-recipients:;) but empty or missing Subject: are not filtered and pass through. This seems like a bug.
Unsurprisingly, attempts to work around this with a filter matching on Subject: have been unsuccessful, since it is not possible to match on nonexisting headers. Matching on an empty Subject - e.g. with ^Subject: $ - does not seem to work either for the same reason.