All emails are whitelisted and appear to be coming from our ISA server, why is that?
In case your ISA is configured to forward requests to Exchange with the option Requests appear to come from the ISA Server Computer (SMTP Rules), ISA will delete the Received: header lines from the email, removing the email delivery path history. This causes ORF to think the email came directly from the ISA server (see Header Analysis in the ORF Help). Change this ISA setting to “Requests appear to come from original clients” in order to preserve the original headers.