[AMaViS-user] Mail Marked Spam For VPN Users

[Carlos M. <car...@gm...>]

On my Postfix server, when my co-workers VPN from their laptops from
home, they then send mail via Outlook and their ISP IP address. When
the message gets to it's recipient, it's marked ***SPAM*** by SA.
User's are complaining that email from internal users are being marked
as 'spam' and they don't know why. When I check the message source, I
can see that the user is connected to their personal ISP
(tampabay.res.rr.com in this case) to tunnel / VPN in and send mail
from their work account. My question is what can I fix to eliminate
this confusion for my co-workers w/o compromising actual spam to get
through? If this is good normal behavior from SA / Postfix, then I
will leave it alone based on your expect recommendations however if
you think I can tune Postfix / SA to handle mail better, I would
greatly appreciate any suggestions. I see below in the headers that
the message is being tagged as spam due to parameters that are typical
or big ISP's. The message source is below:

Return-Path: <el...@my...d>
X-Original-To: sla...@my...d
Delivered-To: sla...@my...d
Received: from localhost (localhost.localdomain [127.0.0.1])
               by mail.mydomain.tld (Postfix) with ESMTP id CD2D7778382;
               Mon, 12 Apr 2010 09:08:57 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mydomain.tld
X-Spam-Flag: YES
X-Spam-Score: 5.266
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.266 tagged_above=-999 required=5
               tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845,
               FSL_HELO_NON_FQDN_1=0.001, HELO_NO_DOMAIN=0.001,
RCVD_IN_PBL=3.335,
               RCVD_IN_SORBS_DUL=0.001, RDNS_DYNAMIC=0.982,
O_EQ_FM_DIRECT_MX=0.001]
               autolearn=no
Received: from mail.mydomain.tld ([127.0.0.1])
               by localhost (mydomain.tld [127.0.0.1]) (amavisd-new, port
10024)
               with LMTP id qDSvk1vgoHls; Mon, 12 Apr 2010 09:08:57 -0400
(EDT)
Received: from elugo2 (165-252.200-68.tampabay.res.rr.com [68.200.252.165])
               by mail.mydomain.tld (Postfix) with ESMTP id ABF3477838C;
               Mon, 12 Apr 2010 09:08:56 -0400 (EDT)
From: "Esteban Lugo" <el...@my...d>
To: "'Esteban Lugo'" <el...@my...d>,
               "'Richard'" <ri...@so...d>,
               "'Scott'" <s...@my...d>,
               "'David'" <d...@my...d>,
               "'Hassan'" <h...@my...d>,
               "'Travis'" <t...@my...d>
References: <000a01caa428$249ebb70$6ddc3250$@org>
<75E1FE1C6E1C924A8F27E609CBE62C3D47E139440D@HVXMSP1.us.somedomain.tld>
In-Reply-To:
Subject: ***SPAM*** RE: WHL Request 4/12-4/16
Date: Mon, 12 Apr 2010 09:08:54 -0400
Message-ID: <000901cada41$4f7bc000$ee734000$@org>
MIME-Version: 1.0
Content-Type: multipart/mixed;
               boundary="----=_NextPart_000_000A_01CADA1F.C86A2000"
X-Mailer: Microsoft Office Outlook 12.0