I am not sure why it is doing this ... but everytime i get a spam, it looks like it does the smap rateing twice. And it gives different scores each time. Here is the new header from the last email I got. Notice how it looks like spamassassin ran twice. Any Idea's ??? (yes, my threshhold is low ... i am just testing what happens when spam arrives).
From the looks of it, you are feeding the mail to SA twice. How do you have SA set up? What tools do you use? are you using both a milter and a call in procmail?
Try to figure out where SA is being called, and pick one method.
As for the different scores, that's not surprising. Since you're using encapsulation, the first time the message is scanned and marked as spam, it's encapsulated in a new message with new headers. This means the second time around the headers are different.
It also looks like you suffer from the ALL_TRUSTED mis-matches caused by having a NATed mailserver.. you might want to look at setting trusted_networks manually to fix that.
