Spam to someone in 'all_spam_to' is also being delivered to other users, without filtering.

This is a side-effect of SpamAssassin's current address-inference system. Since SA does not know exactly which recipient it is run for, or that recipient's email address, it tries to infer the possible list of recipients from the mail message itself (see the previous FAQ entry for the list of headers it uses).

So, if a spam arrives addressed to multiple recipients, and one of those recipients is listed in 'all_spam_to', then that mail message will be shortcircuited automatically, even for the other recipients.

We plan to fix this, but we haven't yet