Bruce,
It is possible directly from cPanel - however there are limitations.
Basically add a filter for the 'Body' (I know we're looking at the 'headers' but I tried it and it didnt work but choosing the 'Body' does - dont ask me!) that 'matches regex' and in the field enter ^((?!xyz).)*$ - this basically triggers the filter if xyz ISN'T contained in the 'Body' (again headers would make sense but body is what works).
Basically this filter will look for xyz and if itsnt there the server can either Discard the msg or forward it to a sustect-spam quarantine account.
Regex are extremely powerful and in this case instead of looking for something (drugs, I AM A SPAMMER etc etc) we are having it look for something that is not there.
The example above is basic as can be if you want to get really complicated you could write it to filter and allow anything.
To mimic Ed Hosting filter requirements he can try: ^((?!xyz|abc).)*$ where abc and xyz are his spam filtering services' domain and total choice hosting's server's domain name respectively. If either abc or xyz appear the message will be delivered correctly. Of course xyz and abc can be replaced with anything you want (server99.snhdns.org is a perfectly valid replacement of abc).
Be careful though if a spammer delivers a msg to your A address (your TCH machine) instead of your MX record bypassing your spam service, abc will appear in the headers and the regex filter above will allow correct delivery anyway.
What i havent been able to have regex do is look for the argument in the first line (but then I havent even been able to have it check the headers at all).
Have fun!