By default, qmail-scanner does not run SpamAssassin on messages from hosts that are in the list of RELAYCLIENTS. This means that if there is an open relay somewhere in those networks, the spam does not get tagged.
Change this behaviour by editing
"/var/qmail/bin/qmail-scanner-queue.pl"
as follows. Change this:
sub spamassassin {
return if (defined($ENV{'RELAYCLIENT'}));
to this:
sub spamassassin {
# return if (defined($ENV{'RELAYCLIENT'}));
Save the file, and ALL messages get scanned. Note that this means even outgoing messages get scanned, this is not a big problem IMHO...