I'm getting a bunch of spam with -90 scores due to 'USER_IN_WHITELIST' ... I know that I haven't added them, so they are being auto-added, apparently by the bayenisian stuff? is there a way of disabling the autowhite feature without disabling the bayes databases themselves?
That's not the Auto-whitelist.. the AWL shows up as AWL in the rule-matches.
They hare hitting one of the static whitelist_from, or whitelist_from_rcvd statements.
Note: if your running an old version USER_IN_WHITELIST can also match the "default" whitelist rules that ship with SA (whitelisting ebay, and other similar domains). If you're using an old version, get out of the dark ages and upgrade to the 2.6x series. Starting with 2.60, the default whitelist entries show as USER_IN_DEF_WHITELIST" so you can tell the difference.
The 2.5x series is also vulnerable to forgeries of the default whitelist entries. That forgery is fixed in 2.6x.
