Thanks for the PMs -- I think it's fixed now.
I think you were right - these were instances where the "envelop sender" (or actual sender) was different from what was in the From: line -- of course, all our trusted and exclusive patterns are based on what we see in the From: line, rather than the envelop sender.
On the old server, spamgourmet code determined what the "from" address was by looking at the headers (and burning a lot of CPU
) - on the new server, the information is passed in from the mail server, which was sending the envelop sender -- for most purposes (just not ours), this is the better address. I made a change to the configuration so that it would send in the From: address also.