Comment 3 for bug 360689

True, but it's far more common that it's bad content sent from a forged address. Not sending backscatter is a clear best pracice these days.

More experienced admins might set up a quarantine/release system (amavisd-new supports this), but such a system is too complex for a default. I think no backscatter is a good default approach. It's easy enough to change for people experienced enough to manage the consequences.