amavisd seems to be involved in this issue; not sure whether it's the 'culprit' or the 'victim'.
A 'ham' mail received through postfix+amavisd+spamassassin arrives with headers ... X-Spam-Flag: NO X-Spam-Score: -2.909 X-Spam-Level: X-Spam-Status: No, score=-2.909 tagged_above=-9999 required=5 tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, SPF_PASS=0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no ... That same email, subsequently re-injected into the same spamassassin instance, but directly ... X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_PASS, T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.1 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) X-Spam-Relay-Country: US US X-Spam-Relays-Untrusted: [ ip=173.255.198.11 rdns=mail2.linode.com helo=mail2.linode.com by=mailhost.DDDD.com ident= envfrom= intl=0 id= auth= msa=0 ] [ ip=198.58.123.173 rdns=li667-173.members.linode.com helo=webserver1.linode.com by=mail2.linode.com ident= envfrom= intl=0 id=0670827182 auth= msa=0 ] X-Spam-ShortCircuit: shortcircuit=no status=no trigger_rule_SCRULE_ ... My SA config /usr/local/etc/spamassassin/local.cf ... clear_headers rewrite_header Subject *SPAM* _STARS(*)_ add_header spam Flag _YESNOCAPS_ add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_ add_header all Level _STARS(*)_ add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) add_header all Relay-Country _RELAYCOUNTRY_ add_header all Relays-Untrusted _RELAYSUNTRUSTED_ ifplugin Mail::SpamAssassin::Plugin::Shortcircuit add_header all ShortCircuit "shortcircuit=_SCTYPE_ status=_SC_ trigger_rule_SCRULE_" shortcircuit_spam_score 100.00 shortcircuit_ham_score -100.00 endif My amavis startup logs /amavisd.log ... Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: using "/usr/local/etc/spamassassin" for site rules pre files Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/init.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v310.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v312.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v320.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v330.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v340.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/v341.pre Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: using "/var/lib/spamassassin/3.004001" for sys rules pre files Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: using "/var/lib/spamassassin/3.004001" for default rules dir Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /var/lib/spamassassin/3.004001/updates_spamassassin_org.cf Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: using "/usr/local/etc/spamassassin" for site rules dir Jun 19 10:22:15 mailhost amavis[3532]: SA dbg: config: read file /usr/local/etc/spamassassin/local.cf ...