Strange whitelist issue

[Pete russell]

I have a spam that is getting through to many users with a -19 score,
the reports says it is

-15.00
USER_IN_DEF_WHITELIST
From: address is in the default white-list


My whitelist contains only this entries

From:           127.0.0.1       yes             #to allow release from
quarantine with mailwatch
FromOrTo:       default         no

Headers for the messages are this

Received: from irpta50.nix.paypal.com (irpta50.nix.paypal.com
[64.4.240.76])
by mail01.mydoimain.com.au (Postfix) with SMTP id E231933D20
for <myuser at mydomain.com.au>; Thu, 20 Nov 2003 20:01:16 +1100 (EST)
Received: from paypal.com (10.192.73.9)
by irpta50.nix.paypal.com with QMQP; 20 Nov 2003 00:42:10 -0800
Date: 20 Nov 2003 08:52:07 -0000
Message-ID: <20031120085207.15682.qmail at bullhorn.nix.paypal.com>
From: <announcements-account at paypal.com>
Subject: Shop safely this Holiday Season
To: "My User" <myuser at mydomain.com.au>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_PayPalMessageSegment-A20031120014492_="
X-Mailer: PayPal Mail Service (2.0.3)

Mailscanner.conf has
SpamAssassin Auto Whitelist = no
Required SpamAssassin Score = 5
High SpamAssassin Score = 15

Any ideas whats going on here? Rh9/postfix2.16/ms4.24-5/clamav.6

Thanks in advance
Pete