Do the mails Pass the IronPort Anti-Spam, or is the CASE Engine not running against the messages due to the reputation?
Are the senders falling into a Sender Group who's MFP doesn't have "Sender Verification" turned on?
Are you reporting these to the Spam address?