Just to make it clear, what happens I define a spam policy at the domain level but leave the user in "Not Enabled"? I think it follows the domain...
Separate names with a comma.
