This is a supportability enhancement request.
Message Audit Log ("MAL") in some cases does not show the offending IP address if it is in the Received Headers but is not the immediate connecting IP address nor is the logical connecting IP address.
When the message is realyed more than one MTAs before it arrives SMG and one of intermediate MTAs happens to be listed in customer's Bad Sender's lists including local bad senders, the MTA's IP address is neither connecting or logical. In such a case, MAL shows an IP-related verdict but the logical / connecting IP address does not offend any bad senders's lists. For the better supportability, the offending IP address in such a case should also be tracked with MAL.
This is an enhancement request which is expected to be addressed in a future release of Symantec Messaging Gateway.