If the VPOP3 spam filter appears not to be working at all, the first thing to do is to look at the message headers of an incoming message to see if the spam filter is being run at all.

Check to see if a header line beginning with X-VPOP3-Spam is in the message headers.

If the X-VPOP3-Spam header is not in the header, then the spam filter is not processing the message.

Some possible reasons for this are:

• The spam filter is disabled. Check this in the VPOP3 settings, at Settings → Spam filter → General. Check the Enable Spam/Content filter on SMTP messages and Enable Spam/Content filter on SMTP messages settings are checked
• VPOP3 is not seeing the message at all - for instance, the message may be arriving via a different route, not via VPOP3. If you look in the message headers for the top header line beginning with Received, this should contain the IP address of the VPOP3 server, and will usually include the text running VPOP3. If this text is not there, then the message may be being received via a different mail server, not VPOP3
• VPOP3 thinks the message has been sent by a local user. If you have configured the SMTP Service component of VPOP3 to allow sending of mail from outside your office, it is possible that you have incorrectly set it to be an open relay, so that VPOP3 trusts all senders, whatever their IP address, and whether or not they are using authentication. In this case, VPOP3 will think that all incoming SMTP messages are actually sent by trusted users, so it will not scan their messages. See the Allowing mail relay through VPOP3 article for instructions on correctly setting up relay access for remote users.

If the X-VPOP3-Spam header line does exist in your incoming messages, then the VPOP3 spam filter is processing the messages, so there must be something making the spam filter think that the messages are not spam.

The most common reason is that someone has added the sender or common text into a spam filter whitelist (Settings → Spam filter → White/Black lists). This may be via a wildcard, so may not be easily seen. If this is the case, then the X-VPOP3-Spam header line will contain a reference to 'whitelist'. The 'X-VPOP3-WL' message header may contain more information.