Here is the maillog lines.

It does look like they pushed the spam to the backup. The first few lines shows the clearsdn.com server delivering the spam message. Since each spam message comes from a different domain, it will come through from an OK from the clearsdn.com IP address. :-(

I never would have checked this despite seeing the clearsdn.com in the maillog.

Unbelievable. So probably the firewall was working OK.

Now to figure out how to stop this.