Might not have had anything to do with spamassassin rules. Found a spurious? file in a logcheck conf directory ignore.d.server. Had a strange name -- " .*R=smarthost" and consisted of entries from the exim4 mainlog. Any idea of how it got there?