[Assp-test] UnknownLocalSender / SpoofedSender for non-local domain

[Zrin Z. <zri...@zi...>]

ASSP version 2.5.5(17223)

Helo all,

I've noticed [UnknownLocalSender] and [SpoofedSender] in the log for an 
external incoming e-mail that has non-local from address:

2018/01/03 20:47:08 08828-29715 [Worker_1] [TLS-in] 212.227.15.4 
<xx...@we...> info: found message size announcement: 9.62 kByte
2018/01/03 20:47:08 08828-29715 [Worker_1] [TLS-in] [UnknownLocalSender] 
212.227.15.4 <xx...@we...> [monitoring] (Invalid Local Sender 
'xx...@we...')
2018/01/03 20:47:08 08828-29715 [Worker_1] [TLS-in] [SpoofedSender] 
212.227.15.4 <xx...@we...> [scoring] (No Spoofing Allowed 
'xx...@we...' in 'mailfrom')
2018/01/03 20:47:08 08828-29715 [Worker_1] [TLS-in] 212.227.15.4 
<xx...@we...> Message-Score: added 37 (slValencePB) for No Spoofing 
Allowed 'xx...@we...' in 'mailfrom', total score for this message is 
now 37
2018/01/03 20:47:09 08828-29715 [Worker_1] [TLS-in] 212.227.15.4 
<xx...@we...> to: rr...@de... info: remove IP-score from 
212.227.15.4 - this mail passed the SPF check
2018/01/03 20:47:09 08828-29715 [Worker_1] [TLS-in] 212.227.15.4 
<xx...@we...> to: rr...@de... Message-Score: added -5 
(spfpValencePB) for SPF pass, total score for this message is now 32

Settings:

LocalAddresses_Flat: <empty>
localDomains: file:files/localdomains.txt
DoVRFY: on

files/localdomains.txt does NOT contain "web.de".

LDAP is not used there.

What can cause this behavior?
What can I do to debug that?

Thank you in advance,
Zrin