The Doctor wrote:
1) I do have user-configs that have whitelists but it seems to have next to no effect. What could be wrong?
Is your SA being *executed* as those users? 99% of site-wide configurations run as one user only, usually root,mail, or nobody.SpamAssassin does not look at the To: header and setuid itself to that user. You must pass -u to spamc, or call spamc from a process already running as that user to get SA to use that particular userid for it's configuration.