All messages are scanned at the Org level when non-account virus filtering is on, however not all messages may get scanned for the user spam settings, i.e. messages sent BCC because the user is not known. All unfiltered messages are from unregistered email addresses, passing through the data center. Look at the traffic recipient & aliases user data, any showing zeros will be an unregistered user.