Although to be totally fair, The spam detection thing is a poorly documented, poorly controlled bolt-on service for the Edge Transport role, which is something that most respectable organizations use a third party smart host for that functionality. The best thing to do with it if you are forced to use an edge transport server in conjunction with a hosted email security appliance is to disable the spam filtering on the edge transport service completely, and even then, it still will pop up for user-created blacklists, which is even worse, because half the time the only thing you'll get is the poor person that accidently blocked them saying "hey, I'm no longer getting legit emails from x.y@z.com" and find out that they tossed them into a blocklist two weeks ago because the sender also sends them garbage emails on top of legit ones...
Biting the hand that feeds IT
