If you have Iframe rejecting enabled, and the message is Klez infected (which uses Iframe), then a notification is still sent to the return address even if Klez is listed as not to generate reports on.