Ok I did verify the spam/ham accounts exist so I think that's not an issue.
SpamAssassin seems to be extremely flexible and powerful but from the novice Linux/e-mail sysadmin point of view it's far from intuitive. I'm wading through the links you both made now to see about getting the spam rules more up to date and ways to keep them up to date.
I haven't searched bugzilla yet but surely an automated spam rule updating system is on the drawing board for Zimbra. I guess an alternate option would be to incorporate a 3rd party spam pre-filtering system (Abaca, etc).
Thanks for the continued help!
Edit: Also, just wanted to make sure I understand what you said on the current AS rule set updates. The server that I upgraded to 5.0.4 we get a *lot* less spam on and this is because is has much newer rules, right? Meanwhile the 4.5.x servers (which is where we're seeing the large increases in spam) are lanquishing under older AS rulesets, hence the need to either upgrade Zimbra or follow one of the threads to get SpamAssassin rules updated.