I've patched spamass milter to let any previously added "X-Spam" headers untouched
Its generally considered bad practice to pass thru X-Spam headers from an unkonwn source. Like most anything else in an email header, a spammer could inject his own headers, probably populated with items designed to generate a negative score.
