POPcon PRO's antispam feature works by checking the IP address of the sending mail server against internet DNS blacklists (RBLs — Real-time Blackhole Lists). If the IP is listed, the email is tagged as spam.
Why false positives occur
DSL and cable ISPs often share IP address pools. If a residential user on the same IP range sent spam, the entire pool may be blacklisted, affecting legitimate senders on that ISP.
Why false negatives occur
Blacklists react to past abuse. A newly compromised server will not be listed immediately — there is always a lag. Additionally, some spam is sent from legitimate servers (compromised accounts).
Content filtering limitation
Content-based spam detection is inherently imperfect because spammers constantly adapt their techniques to evade filters.
Where the check sits in the mail flow, why Exchange's own connection filtering cannot see the original sender of connector-delivered mail, and how to choose between tagging, diverting and deleting is explained in the guide Antispam and antivirus for POP3/IMAP-collected mail before it reaches Exchange.