Padraig,
I see you have the RBLs enabled, so these messages must be coming from non-RBLed sources. Have you noticed any other messages that ARE getting an RBL score? (perhaps ones that actually DID make it into your junk folders?)
The biggest things I'm seeing in this sample are
(1) the BAYES scores of 50% to 80% mean that the Bayesian filters are not identifying them as spam. When you train the Bayesian filters more effectively, you'll see these messages getting a BAYES_99 score, which is the highest you can get. You'll need to run zmtrainsa on some known and trusted spam and ham folders to get enough data for the filter to perform more effectively.
(2) Even with a well-trained BAYES filter you may or may not catch the spam with your present settings, at least until you increase the point value for strong Bayes hits. You may want to increase the Bayes scores for 80, 95, and 99%
(3) You have lowered your tag threshold significantly, since the required point value for spam is only 4 points. This may actually be too low and result in messages that you want, being tagged as junk. Your actual mileage may vary, of course,
but you may find you want to raise that value a little higher than 20 and then just raise the point value of either your RBLs or Bayes or both. It's somewhat a question of surgical targetting vs. nuking. . .
But I think your biggest issue may in fact be that your Bayesian database hasn't had much training. . .it is hard for me to believe that a "toolbox for a womanizer" from a Russian source isn't a strong hit for BOTH Bayes and the RBLs.
Which brings up my other question; you might try your zmprov gacf | grep zimbraMtaRestriction again and see if your RBLs are still active. My own server inexplicably blows them away sometimes (I'm gonna file a separate thread on this, but it's at least in part related to
bug 8146).