I've seen a few uncaught spams lately with ALL_TRUSTED scored. I see that this is determined by a function called check_all_trusted(), but my Perl isn't good enough to work out how this flag is determined. Mails are delivered direct via SMTP, not relayed from anywhere, so I don't see that there should be any trusted relays in the chain.