In iRedMail, as in most mail servers, Spamassassin is set up as an "after-queue" filter.  That means your server first accepts the mail from the sending server, puts it in the local mail queue, and then your Postfix runs the message through Amavis/Spamassassin.  Even if Spamassassin decides the message is spam, it's too late to reject the message because your server already accepted it.

On the other hand, Postfix header checks (and postscreen checks, etc) are done "before-queue", meaning they happen before your Postfix accepts and queues the message.  Therefore, they are able to make Postfix reject a message.

If you don't want tagged spam showing up in your Junk folder, you could have iRedMail quarantine it.

YES.

Amavisd will quarantined detected spam/virus on file system by default.

You can also quarantine them to SQL db by following this tutorial, and manage them with iRedAdmin-Pro:
http://www.iredmail.org/docs/quarantining.html

Hi @ablaha,

Please check our tutorial below:
http://www.iredmail.org/docs/quarantining.html

*) With "$final_spam_destiny = D_DISCARD;" in Amavisd, spam won't be delivered to user's mailbox.
*) With "$spam_quarantine_to = 'spam-quarantine';", Amavisd will quarantine spam.
*) With "$spam_quarantine_method = 'sql:';" Amavisd will quarantine spam to SQL database. Without this setting, Amavisd will use its default setting and quarantine spam to file system -- the directory is defined in parameter "$QUARANTINEDIR", it's a sub-directory of $MYHOME.