I often speak to users of Exchange alternative MDaemon who are wondering why they've suddenly started receiving a larger volume of spam than usual. When I take a look at their installations it's not uncommon to find a secondary mail server in place with its own MX record. It's this second delivery path that can be the root cause of the problem and it's not unusual for the customer to be blissfully unaware either, as quite often they're configured by the DNS provider or their ISP automatically.