All emails coming to a certain domain are being whitelisted, including mail that is getting a high spam score. What is going on?

The most likely explanation of this is that the cPanel user has whitelisted their own domain (i.e. *@theirdomain.com) in the cPanel MailScanner Front-end. By default, when you add a domain or email address to the whitelist in either cPanel or WHM, all mail both TO or FROM that domain will be whitelisted and not marked as spam.

If you or your users need to or want to whitelist their own domain or email addresses, then you will need to change a setting in the WHM MailScanner Front-End Settings. Go to WHM > MailScanner > Front-End Settings, and change Spam whitelisting to "From:" instead of "FromOrTo:".