I have done some reading, but still do not understand this fully as I cannot tell what mine is doing. Here is a snippet of an obvious spam:

X-Virus-Scanned: amavisd-new at mymail.mydomain.com
X-Spam-Flag: NO
X-Spam-Score: 1.043
X-Spam-Level: *
X-Spam-Status: No, score=1.043 tagged_above=-10 required=3
tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_28=1.404,
HTML_IMAGE_RATIO_02=0.437, HTML_MESSAGE=0.001,
MPART_ALT_DIFF_COUNT=1.112, RCVD_IN_DNSWL_NONE=-0.0001,
SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no

I am confused by the BAYES_00=-1.19 score. Where is it defined to user Bayes_00? I looked in /opt/zimbra/conf/local.cf and this is what is in there:
Code:
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################

#   Add *****SPAM***** to the Subject header of spam e-mails
#
# rewrite_header Subject *****SPAM*****


#   Save spam messages as a message/rfc822 MIME attachment instead of
#   modifying the original message (0: off, 2: use text/plain instead)
#
# report_safe 1


#   Set which networks or hosts are considered 'trusted' by your mail
#   server (i.e. not spammers)
#
# trusted_networks 212.17.35.


#   Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock


#   Set the threshold at which a message is considered spam (default: 5.0)
#
# required_score 5.0


#   Use Bayesian classifier (default: 1)
#
use_bayes 1
#   Bayesian classifier auto-learning (default: 1)
#
# bayes_auto_learn 1


#   Set headers which may provide inappropriate cues to the Bayesian
#   classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status


#   Some shortcircuiting, if the plugin is enabled
# 
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
#
#   default: strongly-whitelisted mails are *really* whitelisted now, if the
#   shortcircuiting plugin is active, causing early exit to save CPU load.
#   Uncomment to turn this on
#
# shortcircuit USER_IN_WHITELIST       on
# shortcircuit USER_IN_DEF_WHITELIST   on
# shortcircuit USER_IN_ALL_SPAM_TO     on
# shortcircuit SUBJECT_IN_WHITELIST    on

#   the opposite; blacklisted mails can also save CPU
#
# shortcircuit USER_IN_BLACKLIST       on
# shortcircuit USER_IN_BLACKLIST_TO    on
# shortcircuit SUBJECT_IN_BLACKLIST    on

#   if you have taken the time to correctly specify your "trusted_networks",
#   this is another good way to save CPU
#
# shortcircuit ALL_TRUSTED             on

#   and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99                spam
# shortcircuit BAYES_00                ham

endif # Mail::SpamAssassin::Plugin::Shortcircuit
and this one:
X-Virus-Scanned: amavisd-new at mail.mailserver.com
X-Spam-Flag: NO
X-Spam-Score: -4.633
X-Spam-Level:
X-Spam-Status: No, score=-4.633 tagged_above=-10 required=3
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.377,
HTML_TAG_BALANCE_BODY=1.157, MIME_HTML_ONLY=0.723,
RCVD_IN_RP_CERTIFIED=-3, RCVD_IN_RP_SAFE=-2, SPF_PASS=-0.001,
T_REMOTE_IMAGE=0.01] autolearn=ham


Which is an obvious html spam.

From what I see in conf., pretty much everything is commented out. If that is the case where is it getting the information to run any tests at all? "use_bayes 1" I just uncommented a few minutes ago, but it seems it was using it all along anyway, except I cannot understand the large negative scores. Any help would be appreciated.