I have one client who gets 15-20 spam emails a day. Currently Im using SA 3.0.1. I had auto whitelist and auto learn on and since turned this off. I ran spamd -D on one of the emails that got through that should of been marked spam.
From your log:
debug: metadata: X-Spam-Relays-Trusted: debug: metadata: X-Spam-Relays-Untrusted:
Looks like SA can't parse your received headers and thus assumes "all trusted" because there's no untrusted...
Yet another reason why 3949 needs fixing.
http://bugzilla.spamassassin.org/show_bug.cgi?id=3949
