Summary
Incoming mails that were tagged as SPAM by Interscan Messaging Security Virtual Appliance (IMSVA) (as indicated by "Spam::" in the email subject) are received by Exchange servers with SMEX. These SMEX servers are EUQ enabled. Instead of storing these emails in the users' Spam Mail folder, they are still being stored in users' Inbox or Junk E-mail.
Upon review of the Smex_master.log of one of the Exchange servers, Junk E-mail solution is in place with Trust scan enabled.
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2463)] [DEBUG] spamtype=2, trust=1
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2589)] [DEBUG] Junk E-mail solution, try to update SCL value.
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2597)] [DEBUG] Original SCL: 0
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2607)] [DEBUG] SAT: 8
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2619)] [DEBUG] Modified SCL: 9
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2589)] [DEBUG] Junk E-mail solution, try to update SCL value.
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2597)] [DEBUG] Original SCL: 0
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2607)] [DEBUG] SAT: 8
2012/03/01 09:22:20 +0100 [1868 : 2792] [ filterantispam.dll][ asf_AntiSpamFilter.cpp(2619)] [DEBUG] Modified SCL: 9
Details
The problem is caused by a one or more trusted servers running on Junk Mail Integrated. To address this problem, ensure that EUQ is enabled on the trusted servers (Trust scan enabled).
To switch to EUQ, refer to the article: Activating the EUQ in the ScanMail for Exchange (SMEX) server.
