Actually if adding a domain in the Excluded Domain whitelist, SpamFilter will only check that the mail from address belongs to that domain. This is by design and cannot change, as the admin may wish for a site/company to bypass the filtering rules no matter where their users are connecting from. For this reason, we cannot perform any IP checks on the sender.

If admins chose to a a domain to a sender whitelist, they need to be aware that anyone who is able to guess the whitelisted domain can then fake that email address to send them spam.