yadqfm: spam delivery question

[lists at sbt.net.au]

sorry, yet another dumb question from me:

I've set up +spam delivery with amavisd/postfix/dovecot,
spam messages are delivered to user+spam

BUT, looking at some of the .spam messages I see NOT all have +spam
subaddress:

at this point, I have 15 messages in .spam, but, only 5 have +spam
sub-address:

# grep +spam * | wc
      9      63    1149
# ls | wc
     15      15     820

dumb question, what mechanism delivers the not +spam messages..?

# grep "sa_"  amavisd.conf
$sa_tag_level_deflt  = undef;
$sa_tag2_level_deflt = 5.8;
$sa_kill_level_deflt = 6.9;
$sa_dsn_cutoff_level = 10;
$sa_quarantine_cutoff_level = 20;
$penpals_threshold_high = $sa_kill_level_deflt;
$sa_mail_body_size_limit = 400*1024;
$sa_local_tests_only = 0;
$sa_spam_subject_tag = '***SPAM*** ';