Spam came from users in whitelist

[Reginaldo Bray Mendoza]

Good day.   I have spamassassin working with MailScanner in a redhat linux machine.   Recently, we are receiving SPAM that claims to be from some users that are on whitelist and, for that reason, spamassassin marks them as NOT SPAM (user in whitelist rule scores -100).   What can we do to avoid this??.. is there another way we can secure our whitelist users rather than use spamassassin's whitelist_from rule???   Many Thanks.