Thanks dwmtractor,
ran
/opt/zimbra/bin/zmtrainsa user@domain.com spam folderName from CLI zmtrainsa - Zimbra :: Wiki
manually & learned 30 messages from 34.
i see zmtrainsa in in the zimbra crontab
0 23 * * * /opt/zimbra/bin/zmtrainsa >> /opt/zimbra/log/spamtrain.log 2>&1
does this mean the system would learn these anyway
TIA