When you add an address or set of addresses to the auto-whitelist, they
are added with their case 
intact.

  $ spamassassin -W -D < testspam4
  debug: 32545 Trying to get lock on 
/home/cclark/.spamassassin/auto-whitelist pass 0
  debug: Tie-ing to DB file R/W in 
/home/cclark/.spamassassin/auto-whitelist
  debug: using 
"/usr/local/share/spamassassin" for default rules dir
  debug: using 
"/etc/mail/spamassassin" for site rules dir
  debug: using "/home/cclark/.spamassassin" 
for user state dir
  debug: using "/home/cclark/.spamassassin/user_prefs" for user prefs 
file
  debug: auto-whitelist (db-based): ICMC_0502@mail.ciscomessage.com scores 0/0
  
debug: add_score: New count: 1, new totscore: -100
  [snip some other addresses]
  debug: DB addr 
list: untie-ing and destroying lockfile.
  debug: DB addr list: file locked, breaking 
lock.

But the checks and database operations done during a normal scan
seem to be done with 
email addresses shifted to all lowecase,

  $ spamassassin -t -a -D < testspam4
  debug: using 
"/usr/local/share/spamassassin" for default rules dir
  debug: using 
"/etc/mail/spamassassin" for site rules dir
  debug: using "/home/cclark/.spamassassin" 
for user state dir
  [blah-blah...]
  debug: 32548 Trying to get lock on 
/home/cclark/.spamassassin/auto-whitelist pass 0
  debug: Tie-ing to DB file R/W in 
/home/cclark/.spamassassin/auto-whitelist
  debug: auto-whitelist (db-based): 
icmc_0502@mail.ciscomessage.com scores 0/0
  debug: AWL active, pre-score: 12, mean: undef
  
debug: Post AWL score: 12
  debug: add_score: New count: 1, new totscore: 12
  debug: DB addr 
list: untie-ing and destroying lockfile.
  debug: DB addr list: file locked, breaking 
lock.

Notice that the forced auto-whitelist stores
ICMC_0502@mail.ciscomessage.com 
and the scan puts it all in
lowercase. The two are treated as distinct email addresses.

I 
would suggest that case-insensitivity be built into the
auto-whitelist functions at a low level 
so that problems
like this are taken care of automatically.