You could look into the delivery and smtp logs and that should let you see if it is the overall spam settings or some content filtering kicking in. Is it just one user or multiple users? You can try to add their e-mails to the domain trusted senders list, this should bypass spam filtering.