A SpamCop admin or deputy may manually add an IP address or host name as untrusted because analysis has shown that it does not always report the IP address of the computer forwarding (connecting) to it accurately. You will see this most often with user IP addresses, although sometimes an ISP's mail server may not be trusted or certain software versions.
The second circumstance is one that shows up as "x.x.x.x recently discovered". SpamCop's policy is that an IP address is suspect and not trusted for 48 hours from the first time the reporting system sees the IP address.
This is in response to the high rate of open proxy servers being abused in the sending of spam and allows time for other blocking lists to test and list the IP if it is an open proxy. After 48 hours the IP will become trusted by SpamCop if it has not been listed by one of the blocking lists checked by SpamCop.