There is an overview of the SPAM Blocking process here.
Detect geographic location of clients
Enable geolocation detection of client IP addresses. This identifies the likely geographic location of connecting client IP addresses and can thereby be used to weight, block or delete email originating from specific countries.
Use this to weight block or delete email from countries from which it is unlikely you receive legitimate email
Client IP sender mismatch
If the sender e mail address mismatches the email sending IP location you can choose to mark, weight, block or delete the email