I spoke to some very helpful folks on the MailScanner list (especially Drew) and they sorted me out. I thought I would share in case others run into this problem. First, MailScanner apparently occurs AFTER the postfix virtual mapping takes place... so you have to use the /etc/postfix/aliases vs /etc/postfix/virtual_alias.
Next problem: I had to get /etc/postfix/aliases working together with the /etc/postfix/virtual_alias table. After banging my head on the wall for about a day, the answer was embarrassingly simple. You can't have the same domain in the main.cf variable 'mydestination =' (sends domains in this list to /etc/postfix/aliases) and 'virtual_alias_domains =' (sends these domains to the /etc/postfix/virtual_alias table). So, I did this to create a "fake" subdomain of sample1.com:
/etc/MailScanner/MailScanner.conf Spam Actions = store forward spam@localhost.sample1.com High Scoring Spam Actions = store forward spam@localhost.sample1.com
/etc/postfix/main.cf myhostname = svr.sample1.com mydomain = sample1.com mydestination = $myhostname, localhost.$mydomain virtual_alias_domains = sample1.com, sample2.org
/etc/postfix/virtual_alias joe@sample1.com joeb@localhost joe@sample2.org joeb@localhost bob@sample1.com bob@localhost @sample2.org frank@localhost group1@sample1.com joeb@localhost, bob@localhost, bob@localhost ...
/etc/postfix/alias # Deliver spam to local 'spam' shell account spam@localhost.sample1.com: spam
The trick was using spam@LOCALHOST.sample1.com in both MailScanner.conf AND /etc/postfix/alias (along with having this subdomain of sample1.com listed in mydestination of postfix). These 3 items together allowed local delivery without the virtual_alias stuff getting in the way. MailScanner was now happy and the spam forward worked.
Let me know if folks see a better way of doing this.
Kennedy