Try
journalctl -t spamd --since "1 hour ago"
and
systemctl status spamassassin
to ensure that spamd is running
and that the virtualmin config looks like this
EDIT
you may need/want to remove the
--since "1 hour ago" if you get no results from journalctl