Thank you for the cron job, I’ll definitely add that one.
This is interesting. I have a catchall email address. From what I can see, the messages to the existing email address are being being tagged with Spam headers, the messages directed to “non existent” mailboxes are not being checked by SpamAssassin.