Yes they are added via the custom spam filtering. I have to check with the client as to whether they are going to inbox or junk folder, they might be expecting them to be blocked outright. Also some spam has the key words as sender name, rather than in the subject... Not sure how to classify that.
Not 100% sure but are there any files under /home/yellowtent/boxdata/mail/spamd/<mailboxname> ? Those are the per mailbox spamassassin bayes databases. Maybe it's picking up something from there?