Spamfilter

[tom123]

I'm trying to figure out how spamfilter works.
Actually I have to create a spamfilter user to use white/blacklist.

But there is not check againt this user as I can see, so, user1@domain1.tld can create a user called user2@domain2.tld

Is this ok ? Is not possible to use whitelist and blacklist with no need to create spamfilter user?

Is possibile to set postfix whitelist/blacklist privileges to certain users?
For example, VPS administrator should be able to filter at postfix level, hosting users should not.