I am reporting this as a bug because to me this should work as expected but its not, and because no one has replied to the issue on the forums. See here for the issue https://www.virtualmin.com/node/64564
In summary, we get a lot of spam through even though senders and links in the body are on blacklists like spamhaus.
Running spamassassin on the command line correctly identifies the email as spam.
But running it as normal on incoming email is not identifying it the same as the command line spamassassin, and different rules are added, and its missing all the rules that would identify it as spam.