Mail is being filtered for users listed in 'all_spam_to'.
The "all_spam_to" setting allows SpamAssassin to pass through all messages that match certain address patterns.
However, the mechanism only works if the given email address appears in the TO: or CC: lines of the email itself. It does not examine the delivery envelope, since the MTA generally does not expose this data in the message. Thus BCC'ed emails, those delivered by mailing lists, or those with fake TO: lines will not have the negative score modifier applied.
We can pick up data from some MTAs, but some of them do not tag this data in a usable way for us to pick up. Here's the current list of headers examined: (copied from the code)
Resent-To # std, rfc822 Resent-Cc # std, rfc822 To Apparently-To # sendmail, from envelope Delivered-To # Postfix, I think Envelope-Recipients # qmail: new-inject(1) Apparently-Resent-To # procmailrc manpage X-Envelope-To # procmailrc manpage X-Delivered-To # fastmail.fm, Cyrus (thx Matthew Elvey) Cc
If anyone can suggest others added by other MTAs, it'd be much appreciated.
(thanks to Matt Kettler for large portions of this answer)