Dan,

This is the way all the lists function.  Example (and this is one I hate) a customer doesn't want his mail blocked so he is in the "Unfiltered Email" list.  A piece of crap mail get sent to 10 of our useres with this user being one of them.  All the users get the crap mail.  My solution to that is I add the :SPAM tag to the subject so we can have our mail client filter it out.

In the other direction, the one you are asking about, the action is the same.  I believe the general thinking is that if there is an address in the list that is not authorized, it is most likely Spam.  This, unfortunately, doesn't account for "used to be users" or even a mispelled CC address.  I was using the Authorized list on my "personal" mail server and it really helped to nail boat loads of garbage but I did need to watch for the issue you speak of.  I ended up NOT using the authorized list and instead spent about an hour writing a RegEx to block all but my valid mail addresses.  This is only practical because I only have 25 users on that server.

Sorry I could not be of more help.

Dan S.