Is there a way with spamassassin local.conf to add a higher score based on source ip address or subnet? Basically the last IP in "Received:" header.
bad_subnet_add_20_points: 192.168.240.0/24 Raising the score if that IP appeared anywhere in headers or body might work too.