E-Mail gets deleted by what seems to be Local Bad Sender Domains policy but sender's e-mail address or domain visible in Message Audit Log (MAL) cannot be found on the Local Bad Sender Domains list.
MAL entry displays following information: - Verdict: System denied email address or domain - Filter Policy: static deny email address - Action taken: delete message
Screenshot of MAL verdict:
This works as designed.
Message Audit Log is designed to display so called "Envelope Sender" information. Local Bad Sender Domains policy in SMG applies to information contained in "Envelope Sender" (i.e MAIL FROM: field) as well as "Message Body" (i.e. From: field) parts of e-mail message.