Probably you haven't set trusted_networks and/or internal_networks correctly, and you are getting ALL_TRUSTED firing on the incoming mail from some of the boxes. This will add some negative points, and possibly result in the mail not being marked as spam. Depending on what you are using to call SA, some things don't include spam scanning headers if they think it is ham.
Loren
