Spam with forged From=To ;local domain whitelisted

[Christopher Albert]

Greetings,

I have been using mailscanner + sophos+spamassassin+vipul's_razor with great
success for several months now. I have had to put my local domain, and well
as the university domain in the spam whitelist to avoid false positives,
given the amount of bulk mail taht circulates locally. This has worked fine
since all the spam comes from outside. However, a couple days ago we
received some spam with forged from address equal to the recipient address,
and that being from the local domain were not tagged as spam.

Where in the pipeline can I control for this kind of scam?

TIA,

Chris