Dwight,

Sometimes emails will have a "From:" header with one address, but will have the "true" return address as something different. This "true" address is specified in the MAIL FROM command, and will usually appear in the "Return-Path" header. SpamFilter will act on the "true" address, not on the one specified in the "From:" header. If you whitelist this "true" address the this will indeed bypass all the other filters.

The "IP blocked by honeypot autofilter" is a bit tricky. This indicates that the email was blocked because the remote IP address has been used in the past to send *another* email addressed to an email address in your honeypot email list.

To find out exactly why that IP is being blocked you would have to scan thru all your logs to see when it was added to the IP honeypot list. This event will be logged as:

Added aaa.bbb.ccc.ddd to honeypot blacklist

Once you find that line, you will be able to see what email address the email was sent to (that email address was then at one point added by you as a "honeypot" to catch spammers).