This can happen for one of two reasons.

1.) Your Hijack thresholds are too high. You can lower them in the Hijack.cfg file. We suggest 10/20 for relay threshold 1 (20 emails allowed to be sent within 10 min.) and 30/80 for relay threshold 2 (80 emails allowed to be sent within 30 min.).

2.) Hijack is counting spammers by IP instead of sender address. You should enable HIJADDR in the Hijack.cfg file. Simply uncomment HIJADDR ON and save the file.