The reason is that the spammers sometimes ignore the changes you made to the MX records for your domain. Instead they continue to use your old mail server when they send spam to your domains. Not all spammers do this and most of the time you just have to wait some extra time before the spammers start to use the new MX which points to SpamDrain's servers. Nevertheless, we always recommend that you add some rules to the firewall which protects your mail server. This should be done only after the change of the MX records has been propagated through out the Internet - this usually happens after a couple of days.
Configure your mail server's firewall so that only SpamDrain's servers may connect to the mail server. This means that only the following IP addresses should be allowed to connect to TCP port 25 on your mail server:
22.214.171.124 - 126.96.36.199 (188.8.131.52/27)