Header check question

[thule]

We use postfix, with spam assassin and Amavis and it catches tons of spam. I have a couple of users whose accounts by their fault became spam magnets. I gave them new accounts and am trying reject mail in the header checks to field to reject mail. It works great when testing from any message sent from a web based account (say google mail), however testing it with a local outlook express mail account (outside the organization) the mail gets passed through without the "to" address field being checked. This would not be a problem except mail get's qued up when bogus return addresses are on the return and a 550 message is sent from the mail server. This one is driving me crazy, I can't figure out why it works from webmail but not from a localized mail program.

Thanks in advance for any place you know of that might provide a solution.