What I've read in the KB/help articles is that if a message is over the max scanning size, content scanning, including CommTouch/Cyren, is skipped. The below delivery report seems to say otherwise:
11:59:54  Delivery started for firstname.lastname@example.org at 11:59:54 AM
12:01:24  Message exceeds maximum scanning size, skipping content based checks.
12:01:24  Spam check results: [SPAMCOP: passed], [UCEPROTECT LEVEL 2: passed], [UCEPROTECT LEVEL 3: passed], [_REVERSEDNSLOOKUP: passed], [_COMMTOUCH: 30,Confirmed]
12:01:29  Starting local delivery to email@example.com
What is happening here?
Thanks for any input.