I think that careful reading of https://www.debian.org/doc/debian-policy/ch-relationships.html#s-virtual will be the best way to understand the situation here, but the most important thing is that virtual packages can't have version numbers. Therefore the line "Provides: php-math-biginteger (= 1.0.2+phpseclib)" is broken, and currently appears to be ignored completely (but if the syntax checking of the control file is ever made any stricter, it could cause the package to be rejected). However, fixing it wouldn't help, because php-horde-mapi depends on php-math-biginteger with version constraints, so no virtual package can satisfy that dependency.
-- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org