If you put an address on the whitelist which is also in a 'local domain', then, by default VPOP3 will ignore that when checking incoming mail. This is because spammers often send spam pretending to be from the same domain as the recipient. In most cases, mail from local domains will be sent locally, not incoming, so, usually, this is a sensible rule to follow.
If you look in the messages headers of a filtered message, then VPOP3 will add a header line like:
X-VPOP3-WL: Skip Local (email.address)
if this is happening and you want to tell VPOP3 to check the whitelist for incoming mail from local domain email addresses as well, then go to Settings → Spamfilter → General, go to the Script Configuration tab, and set CheckLocalWhitelist to 1.
Note that in many cases, external users can actually send mail through VPOP3 as if they were local users, so their mail won't be spam filtered at all.