If a privacy list with a disallow fall-through is active, stanzas send from the server (i..e. from="myserver.com"), are also blocked. XEP-0016 is not clear on that topic, but
it's of no use to filter stanzas that originate from the server
this behavior needs an ugly workaround where an affected privacy list must contain a JID filter rule that matches the services name
Patch busts openfire, reopening
I am not sure, if the current behavior is already correct. Messages being blocked by the server (due to XEP-0016) is the main/sole reason, why XEP-0249 exists.
There you can read:
Unfortunately, a mediated invitation might not be delivered to the contact, for example if the contact blocks communication with entities not in its roster as specified in Privacy Lists (XEP-0016) [2]. As privacy lists have become more common, MUC invitations have been increasingly blocked at the server side, resulting in an undesirable user experience. Therefore, this specification defines a method....