We see lines like this on authenticated messages in the delivery logs:
[2014.09.16] 01:00:25  Skipping spam checks: User authenticated
Unless I'm missing something somewhere, it would appear that these messages also skip the Content Filtering phase. We would like to use the Content Filtering to help organization, rather than spam control. We need to be able to have the filtering run on these types of messages.
Am I missing something? Is there a setting that controls this behavior somewhere?