There is a small problem with logwatch and Zimbra´s SpamAssassin default setup.
Logwatch finds blacklisted URLs in the logs and sends a report to the system admin. As the content contains black listed URLs, the e-mail is tagged as spam. See the URIBL fields below
X-Spam-Status: Yes, score=7.528 tagged_above=-10 required=6.6 autolearn=no
tests=[ALL_TRUSTED=-1.8, AWL=-7.294, BAYES_00=-2.599, BIZ_TLD=2.013,
DSPAM_SPAM=0.5, NORMAL_HTTP_TO_IP=0.175, URIBL_JP_SURBL=4.087,
URIBL_OB_SURBL=3.008, URIBL_PH_SURBL=2.8, URIBL_SC_SURBL=4.498,
So far I bypass this by adding 127.0.0. to "trusted_networks" in conf/salocal.conf, but each new update removes the line.