Mail is being filtered for users listed in 'all_spam_to'.
The "all_spam_to" setting allows SpamAssassin to pass through all messages that match certain address patterns.
However, the mechanism only works if the given email address appears in the TO: or CC: lines of the email itself. It does not examine the delivery envelope, since the MTA generally does not expose this data in the message. Thus BCC'ed emails, those delivered by mailing lists, or those with fake TO: lines will not have the negative score modifier applied.
We can pick up data from some MTAs, but some of them do not tag this data in a usable way for us to pick up. Here's the current list of headers examined: (copied from the code)
Resent-To # std, rfc822
Resent-Cc # std, rfc822
To
Apparently-To # sendmail, from envelope
Delivered-To # Postfix, I think
Envelope-Recipients # qmail: new-inject(1)
Apparently-Resent-To # procmailrc manpage
X-Envelope-To # procmailrc manpage
Cc
If anyone can suggest others added by other MTAs, it'd be much appreciated.
(update: Matthew Elvey notes that Cyrus (or fastmail.fm at least) also uses X-Delivered-To for this. thanks to Matt Kettler for large portions of this answer)