not really made any progress, i just don't know enough about linux

the mail is checked against spamlist at spamcop or spamhaus, by mailscanner
this is the last line in mailscanner.conf
SpamAssassin Prefs File = /etc/MailScanner/spam.assassin.prefs.conf
so i believe spamassassin is running
and a lot of emails everyday are sent to spam on the server (14,000 since may 6), but hundreds are still getting through, i have about 1000 since july 10, just to my mailbox