I have Qmail / vpopmail / courier-imap / spamassassin. My SA rules are stored in local.cf (see below) as well as a mysql db for users to change their settings. Any new users I add get the settings from local.cf (good). Any existing users seem to be getting rules from somewhere else. I can't figure it out, the mysql db does not list these users.
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
###########################################################################
#
# rewrite_subject 0
# report_safe 1
# trusted_networks 212.17.35.
user_scores_dsn DBI:mysql:spamassassin:localhost
user_scores_sql_username spamassassin
user_scores_sql_password mypassword
# How many hits before a message is considered spam.
required_hits 5.5
# Whether to change the subject of suspected spam
rewrite_subject 1
# Text to prepend to subject if rewrite_subject is used
subject_tag *****SPAM*****
# Encapsulate spam in an attachment
report_safe 1
# Use terse version of the spam report
use_terse_report 0
# Enable the Bayes system
use_bayes 1
# Enable Bayes auto-learning
auto_learn 1
# Enable or disable network checks
skip_rbl_checks 0
use_razor2 1
use_dcc 1
use_pyzor 1
# Mail using languages used in these country codes will not be marked
# as being possibly spam in a foreign language.
ok_languages all
# Mail using locales used in these country codes will not be marked
# as being possibly spam in a foreign language.
ok_locales all
#Allow and disallow domains
#Nooro and wesearch are (of course) allowed, pipeline is here for testing
whitelist_from *@domain1.com
whitelist_from *@domain2.com
blacklist_from
spamtest@domain3.net