12/26/07 23:56:26:006 -- (55724) Bypassed all rules for: user@domain.net from remoteuser@domain.net (Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering)
12/26/07 23:56:27:615 -- (55724) Starting quarantine procedures
12/26/07 23:56:27:740 -- (55724) Created thread (31696) to add email to quarantine
12/26/07 23:56:27:740 -- (31696) Adding to Quarantine file:Qrt161C.tmp
12/26/07 23:56:47:459 -- (31696) EMail from remoteuser@domain.net to user@domain.net was received and quarantined. Size: 5948 KB, 6090752 bytes

Starting from version 3.5.4.728 we introduced the following option in the SpamFilter.ini file:

// New to VersionNumber = '3.5.4.728';
{TODO -cNew : Added option MaxMsgSizeForSpamFiltering in SpamFilter.ini file to whitelist emails that are larger than a specific size}

;Any emails whose text portion exceeds this number of KB will be whitelisted. Most spam emails are small in size, lowering this value may help in reducing the chances of incorrectly blocking valid emails with large attachments
MaxMsgSizeForSpamFiltering=768

The log entry you posted indicates that this email was larger in size than the above value, and was thus allowed to bypass all filtering rules.

You are correct, and we did verify that this is a bug. That setting (MaxMsgSizeForSpamFiltering) is
sometimes ignored if an email fails the IP-based tests. We'll have this fixed int he next build of SpamFilter that will be released within the next few days.