SpamAssassin Milter
Try to get this milter put into the new Sendmail/SpamAssassin configuration. It seems to be the case that this will allow SpamAssassin to run and reject mail as the other rules do, instead of waiting until after acceptance of the message.
Try to ensure that the milter can run the spamc in a way to get spamd to use the user settings for whitelist and other configurations. Also, try to get the system-wide Bayesian filter so that training can be shared. Given the small use now, and the anticipated large use later, it'd be nice to be able to filter more junk sooner.
The goal is to try to reject as much UBE before it hits the procmail/mailbox so that the far-side servers will (hopefully) start to stop sending it.
If this does not reject before accepting, do not use it, as the current procmail configuration is at least cleaning the mail, and we don't need to run the check twice.
If this does scan the messages before accepting them, it should be the case we can alter the procmail to no longer run spamc (unless we want to per-user for additional rule checking), but continue to run the procmail to help streamline the handling of known junk (e.g., move all X-SPAM: YES headers to spam-mail folders), instead of requiring individual user configurations for that common stuff.