My guess - if you examine the headers of your spam messages you will see
that some message are 'autolearned'. Message that generate a high enough
'spam value' get internally fed to 'sa-learn' and are marked with
'autolearn=spam' in the X-Spam-Status header. Once a message has been
trained via sa-le
> Learned from 304 message(s) (30419 message(s) examined)
> Learned from 253 message(s) (30430 message(s) examined)
> Learned from 301 message(s) (30452 message(s) examined)
I bet you are seeing some spam re-learning after it has fallen off of
the expiry backend.
so the line:
Learned from 253 mess
