Not only that but the whole email gets re-written as well with the body of the email becoming the Spamassassin report. I.e.,
pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, low trust [217.69.128.173 listed in list.dnswl.org] -100 USER_IN_WHITELIST From: address is in the user's white-list 2.0 RATWARE_MPOP_WEBMAIL Bulk email fingerprint (mPOP Web-Mail) 0.0 FREEMAIL_FROM Sender email is freemail (lenamariay[at]mail.ru) -0.0 SPF_PASS SPF: sender matches SPF record -100 USER_IN_SPF_WHITELIST From: address is in the user's SPF whitelist 2.3 FSL_RU_URL URI: FSL_RU_URL -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 MIME_BASE64_BLANKS RAW: Extra blank lines in base64 encoding 1.8 MISSING_SUBJECT Missing Subject: header 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid Check out "From: address is in the user's white-list" I should have read the report better. So how come is it still considered spam?