Mihai has helped me a lot in troubleshooting and analyzing the problem. We then found out that the spam messages actually came from real human located in Nigeria / Lagos and so the plugin allows the messages to pass through, which is what it is supposed to do. I’ve blacklisted the IP from Nigeria (197.210.225.*) under GBC security setting as suggested by Mihai.
