USER_IN_DEF_WHITELIST wrongly triggers

[Greg Troxel <gd...@ir.bbn.com>]

I got the following spam, and am feeling that USER_IN_DEF_WHITELIST at
-15 is not really the right thing to be doing - but I know there are
often good reasons for the SA decisions.

spamassassin -t says:

 -15 USER_IN_DEF_WHITELIST  From: address is in the default white-list

and this is misleading, as it's really the envelope sender:

[7751] dbg: rules: address yahoo-dev-null@yahoo-inc.com matches (def_)whitelist_from_rcvd ^.*\@yahoo\-inc\.com$ yahoo.com
[7751] dbg: rules: ran eval rule USER_IN_DEF_WHITELIST ======> got hit (1)

So, I wonder:

  is the -15 really justified?

  why is yahoo-dev-null@yahoo-inc.com in the default whitelist?

  shouldn't addresses from senders known to use dkim/etc. only be
  recognized if a dkim signature is present (assuming there is dkim
  support).

All that said, this is my first spam that got through because of
USER_IN_DEF_WHITELIST, where got through means score < 1.0.