"spamassassin --lint -D" will show what rule files are being used. Weekly is probably a good choice, daily is as frequent as I would suggest at the moment.
It uses DNS to detect new updates, doesn't it? So one could use a frequency as high as the record TTL at very low cost.
