I've discovered that my allow_postmaster plugin isn't doing what I want it do, namely allow to postmaster from anybody. It turns out that the spamassassin plugin is still running, and still DENY'ing spam, even to postmaster.
My config/plugins has allow_postmaster first, and spamassassin last. I'm running 0.25; looked at the change log for 0.26 but didn't see any evidence of this being fixed in 0.26. I also see that there's a 0.27 almost out, don't know whether it's fixed there. Looking at the code, I suspect that the problem is that allow_postmaster needs to register for the data_post, and possibly other hooks as well, but I'm not sure. Before I spend some time debugging this, has anybody else seen it? Suggestions or fixes? If not, I'll post the fix here when I figure it out.