The auto-whitelist has nothing to do with anything that says WHITELISTED.
The auto-whitelist will show up as a rule named AWL. Nothing else.
That said, can you be VERY specific about what your headers say?
Does it say USER_IN_WHITELIST?
If so, check your whitelist_from and whitelist_from_rcvd entries.
It says, precisely:
X-Spam-Status: No, hits=- tagged_above=-9999.0 required=5.0 WHITELISTED
So if its not whitelist_from or the AWL, what can it be?
Well, disabling the loadplugin should do it. That said, did you restart
amavis after doing so? (these files only get parsed when a SA instance
starts up, and amavis keeps its own perl-API based copy of SA in order
to avoid the waste of calling out to external commands like spamc or
spamassassin)
AWL was never enabled, and I did restart amavis many times. The
loadplugin line is commented out and I restarted amavis just now to make
absolutely sure, deleted the auto-whitelist file, but back it came. I
don't get it.