While the Spam Assassin service is a great tool at fighting against incoming SPAM messages, unwanted emails continue to change in order to try and bypass these checks. To help the protection for this service keep up with your needs, the sa-learn utility(/usr/local/cpanel/3rdparty/bin/sa-learn) is included with the software installation by default. This tool can be used to teach the Spam Assassin database what messages you deem as spam or ham(legitimate mail) directly, in order to update its detection database to meet your personal needs.
In order to use the sa-learn tool, the Spam Assassin service with need to be enabled and running for the related account. That account will also need to be configured to use the Maildir message storage so that individual message files can be passed to the command. It is also advisable that auto-delete be disabled for Spam Assassin so that any false positives can be marked as Ham.
With the above criteria met, you can then use the sa-learn command to mark specific emails as SPAM or HAM. The recommended method is to create a specific directory to store the messages that you wish to be processed and create a cron for the associated cPanel account to perform this task automatically. Alternatively, you can log in to SSH as the cPanel user and perform this task manually.
For detailed steps on configuring and using the sa-learn utility, please see the following link: