Fastpass can be granted to sender IPs that are on the Bad Sender IP list if clean messages are scanned from the bad sender IP.
The fastpass counter is incremented for clean messages that are scanned regardless of whether that IP is on the Bad Sender IPs list.
While the bad sender IP may receive a fastpass, it will only affect spam scanning verdicts and does not change the action taken. Other verdicts achieved, such as malware, content filters, and reputation, will still take effect.
To work around this issue, configure Bad Sender IP actions to reject (the default setting) or defer the SMTP connection so email is not scanned from these IPs. This will prevent the potential of crafted clean messages being scanned from these IPs.