This is expected with the delivered security because those replies check against the case ACLs to confirm whether the user actually has access to write updates to the case. I assume that the users that have their emails ignored would not be able to update the case through the agent view either? If these are other HR agents that have access to update the case, you may be able to add them as collaborators.
This shouldn't be specific to the scoped application though; your organization may have modified security in the legacy application to make an exception for inbound emails. The ACLs would likely need to be modified in the scoped application as well to handle this situation if it is a requirement to support non-HR case workers updating the case via email.
