Symptoms
When using a Backup MX server, email bypasses any spam filters in place on the local cPanel & WHM server.
Description
By design, a Backup MX server is considered a trusted mail server. All mail from that host will be accepted and is exempt from SpamAssassin and other anti-spam checks done on the local cPanel & WHM server.
The cPanel & WHM server expects that the Backup MX server performed anti-spam checks already on the Backup MX server and that all mail arriving from a Backup MX is desirable mail.
Please see the following diagram for a high-level view of the expected implementation of a Backup MX server.
Workaround
Implement SpamAssassin and other anti-spam checks at the "Backup MX" server to scan all mail before being delivered to the cPanel & WHM server.