The Received header parsing code can determine the trust boundary
incorrectly if the message is relayed from a private network,
through a public network, and back into a similarly numbered
(same class B) private network.  The bug "happens" here, although
it's easily debatable that it's caused where $first_by is set:

      # if the 'from' IP addr shares the same class B mask (/16) as
      # the first relay found in the message, it's still on the
      # user's network.
      elsif (Mail::SpamAssassin::Util::ips_match_in_16_mask
                                        ([ $relay->{ip} ], $first_by))
      {
        dbg("received-header: 'from' ".$relay->{ip}." is near to first 'by'");
        $inferred_as_trusted = 1;
      }