affect only messages sent locally by untrusted users; (2) a user is
"untrusted" if and only if he is not in trusted_users and he is not a
member of a group in trusted_groups; and (3) a trusted user's local
messages are never subjected to Sender-overwriting and the local-From
test.