Some mail that has SCL: 9 are not all going to 'Junk Email' folder. Most are, but some slip through. There are several organizations on this exchange system, and this is happening to all users.
Get-OrganizationConfig for SCLJunkThreshold is '4'
SCLJunkEnabled for users is 'Yes'
Here is the header of a message that was marked as spam but went to the Inbox:
Received: from MBX1.domain.com (192.168.2.5) by MBX2.domain.com
(10.1.1.7) with Microsoft SMTP Server (TLS) id 15.0.775.38 via Mailbox
Transport; Mon, 9 Jun 2014 09:02:44 -0700
Received: from CAS2.domain.com (10.1.1.2) by MBX1.domain.com
(192.168.2.5) with Microsoft SMTP Server (TLS) id 15.0.775.38; Mon, 9 Jun
2014 09:01:20 -0700
Received: from smtp1.domain.com (10.1.1.3) by CAS2.domain.com
(10.1.1.2) with Microsoft SMTP Server id 15.0.775.38 via Frontend Transport;
Mon, 9 Jun 2014 09:02:43 -0700
Received: by smtp1.domain.com (Postfix, from userid 501) id 2293BC033F;
Mon, 9 Jun 2014 08:19:13 -0700 (PDT)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.domain.com
X-Spam-Level:
X-Spam-Status: No, score=1.0 required=3.0 tests=BAYES_00,DATE_IN_PAST_06_12,
HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET shortcircuit=no autolearn=no version=3.3.1
Received: from web2.domain.com (web2.domain.com [1.2.3.4]) by
smtp1.domain.com (Postfix) with ESMTP id 6D6D8C02E2; Mon, 9 Jun 2014
08:19:07 -0700 (PDT)
Received: from [198.0.89.233] (port=22316 helo=easthou-dc1.ehosm.com) by
web2.domain.com with esmtp (Exim 4.80.1) (envelope-from
<infiltratora2@raywhite.com>) id 1Wu1wH-0006gx-GG; Mon, 09 Jun 2014 08:56:50
-0700
Message-ID: <7J2N7PLH.6428091@raywhite.com>
Date: Mon, 9 Jun 2014 07:33:39 +0000
From: American Express Customer Service <AmericanExpress@welcome.aexp.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: <user@domain.com>
Content-Type: multipart/alternative;
boundary="------------000101080607090805060900"
Subject: ***SPAM*** American Express - Safe Key
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - web2.domain.com
X-AntiAbuse: Original Domain - domain.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - raywhite.com
X-Get-Message-Sender-Via: web2.domain.com: mailgid no entry from get_relayhosts_entry
Return-Path: infiltratora2@raywhite.com
X-MS-Exchange-Organization-Network-Message-Id: 45f62fb3-2fdb-4efa-5a86-08d152133032
X-MS-Exchange-Organization-SCL: 9
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.5705.600;TIME:TimeBasedFeatures;OrigIP:unavailable
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-AuthSource: CAS2.domain.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-EsetId: 37303A291EC25A6B637562