When mail is processed by SA ( spamc/spamd from procmail in this example), it adds all the X-Spam headers at the beginning of the mail (prepend).
I don't want to be one of those jerks who tells you to read the list archives for an answer, but I know this subject has been raised several times since the release of 3.1.0.
