sympl-mail: A default-forward configured for a domain bypasses SpamAssassin filtering
Seems likely its an order of execution thing - the mail is being handled by the delivery function before it's been scanned.
IIRC, this was an issue with Symbiosis as well, so likely has been around a while.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information