I found a way to use spamassassin to scan ALL email coming to the site.

mv /var/qmail/bin/qmail-queue /var/qmail/qumail-queue.for_spamc

Create a new /var/qmail/bin/qmail-queue containing:
+++++++++++++++++++
#!/bin/sh

/usr/bin/spamc -s 10485760 | /var/qmail/bin/qmail-queue.for_spamc
+++++++++++++++++++
Set appropriate ownership and permissions for new qmail-queue. Set -s to the largest file size you are willing to scan. Create /var/qmail/.spamassassin owned by popuser: popuser.

This will scan everything early in the qmail sequence.

I don't know how it will interact with user preferences.

I've just implemented this and it seems to work for my purposes. Use at your own risk