This just seems odd to me that the secondary MX record would receive a much higher volume of spam and wondered of anyone else was seeing this and if there was an explanation.
That's simple to explain.. Many sites are foolish enough to only have spam filtering on their primary MX, and have their secondary MX deliver to their internal servers un-scanned. Generaly this happens when the secondary is a very low-end "spare" box (like the old primary MX from 8 years ago).
Spammers are counting on at least a few sites suffering from this config problem, and many spammers prefer delivery to secondary MX'es for that reason.
