The subst call takes your template and does variable, function, and backslash substitution on it. I suspect that one of the routines that is called by im_status_report must be trying to access ad_sec_user_id. You might have to settle for putting just a link to the status report in your spam template. If you really want this to work, you could try digging into im_status_report. im_status_report has a list of routines that it evals to form the overall report. It's probable that one of those subroutines uses ad_sec_user_id. It seems that wherever user_id is needed in intranet-defs.tcl, there is an access to ad_sec_user_id.
