The most likely explanation of this is that the cPanel user has whitelisted their own domain (i.e. *@theirdomain.com) in the cPanel MailScanner Front-end. By default, when you add a domain or email address to the whitelist in either cPanel or WHM, all mail both TO or FROM that domain will be whitelisted and not marked as spam.
If you or your users need to or want to whitelist their own domain or email addresses, then you will need to change a setting in the WHM MailScanner Front-End Settings (from MS Front-end v3.0). Go to WHM > MailScanner > Front-End Settings, and change Spam whitelisting to "From:" instead of "FromOrTo:".
