it turns out the email address of the 'author', in my case, had a notoriously weird email history.
the subscribed email address was actually an address that was forwarded-to from another email address, and their local email client was pulling mail from multiple addresses.
it's quite likely that the address attached to the email from the email client was not the same as the subscribed address, which might explain why the email messages were allowed into the closed group but didn't match the 'allow in future' directive, or something like that.
just thought i'd add that - maybe check with the sender to see if they have any funny business going on with how they send email or use multiple email addresses.