Kris,

Is the "good email address," or anything having to do with it -- the domain it's in, the IP address it's coming from, etc. -- listed in any of your whitelists (other than the Allowed Domains whitelist)?  Also... are you using the "Keywords Whitelist" and if so, does the inbound message contain any of the keywords included in this list?

Basically what I'm asking is whether you have a whitelist exception of some sort that might be allowing the message to go through.  SpamFilter processes almost all of the whitelists FIRST (before the blacklists) and if a whitelist match is made, then the mail is accepted with no further conditions (and none of the blacklists) checked.

One way to verify whether this is happening would be to look on your SpamFilter log screen (or the log file) and see if you see "bypassed all rules for..." logged in association with that message.  This "bypassed all rules for..." message is an indication that a whitelist match was made, and SpamFilter is accepting the message without further tests.

Jim

If I understand correctly you are saying that you have a good email address and a bad email address on the TO line of the same email message. Yes, if any of the email addresses on the TO line are valid, the email gets delivered. This is because, from what I've seen, the email is not "rebuilt", it is delivered "as-is" and if one address is whitelisted it gets delivered to the destination SMTP server which in turn delivers it to everyone on the TO line.

bill