I started having this issue after upgrading to version 7.0 from 6.10... Now, not all emails are being deferred, only some important emails are being deferred and all end up being forwarded to spam. I am also unable to access the spam mailbox from webadmin like I do with the other emails.
Something got changed after the upgrade. When I did a telnet, I get the following message:

*note* The domain name and ip's are made up....

Code:
telnet zimbra.domain.main.com 10025
Trying 192.168.222.***...
telnet: Unable to connect to remote host: Connection refused
Code:
sender: mailer-daemon
from host: localhost.localdomain
from domain:
from ip: 127.0.0.1
Recipients: spam@zimbra.domain.main.com
To domain: zimbra.domain.main.com
content filter:
size:9706

Reason: connect to domain.main.com [192.168.222.***]:7025:connection timed out

These are my settings:
ee hosts
Code:
127.0.0.1           localhost.localdomain localhost
192.168.222.*** zimbra.domain.main.com  zimbra

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
ee resolv.conf
Code:
search main.com
nameserver 192.168.111.***
nameserver 192.168.110.***
nameserver 192.168.109.***
host `hostname`
Code:
Host zimbra not found: 3(NXDOMAIN)
dig zimbra.domain.main.com mx
Code:
; <<>> DiG 9.4.2-P2 <<>> zimbra.domain.main.com mx
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61065
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4

;; QUESTION SECTION:
;zimbra.domain.main.com.         IN      MX

;; ANSWER SECTION:
zimbra.domain.main.com.  60000   IN      MX      100 zimbra.domain.main.com.

;; AUTHORITY SECTION:
main.com.                60000   IN      NS      ns2.main.com.
main.com.                60000   IN      NS      ns1.main.com.
main.com.                60000   IN      NS      noc.main.com.

;; ADDITIONAL SECTION:
zimbra.domain.main.com.  60000   IN      A       192.168.222.***
noc.main.com.            60000   IN      A       192.168.111.***
ns1.main.com.            60000   IN      A       192.168.110.***
ns2.main.com.            60000   IN      A       192.168.109.***

;; Query time: 1 msec
;; SERVER: 192.168.111.***#53(192.168.111.***)
;; WHEN: Thu Feb 17 12:34:14 2011
;; MSG SIZE  rcvd: 173
dig zimbra.domain.main.com any
Code:
; <<>> DiG 9.4.2-P2 <<>> zimbra.domain.main.com any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12104
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;zimbra.domain.main.com.         IN      ANY

;; ANSWER SECTION:
zimbra.domain.main.com.  60000   IN      A       192.168.222.***
zimbra.domain.main.com.  60000   IN      MX      100 zimbra.domain.main.com.

;; AUTHORITY SECTION:
main.com.                60000   IN      NS      ns2.main.com.
main.com.                60000   IN      NS      ns1.main.com.
main.com.                60000   IN      NS      noc.main.com.

;; ADDITIONAL SECTION:
noc.main.com.            60000   IN      A       192.168.111.***
ns1.main.com.            60000   IN      A       192.168.110.***
ns2.main.com.            60000   IN      A       192.168.109.***


;; Query time: 1 msec
;; SERVER: 192.168.111.***#53(192.168.111.***)
;; WHEN: Thu Feb 17 12:38:02 2011
;; MSG SIZE  rcvd: 173