As your sample spams have headers that MimeDefang did NOT add to each message, SOMETHING ELSE is reviewing and operating on the message. If you call SA from MD, you should not be calling it directly, nor should you have something else call SA. However, it is obvious that your configuration is doing exactly that.