There are several reasons. To find out, you'll need to post the keyword you're using, the email's source, and the section of SpamFilter's activity logfile that shows the entires relative to that email (all related logfile entries share the same threadID number - the number in parenthesis in the log).