Show which rule a PASSED SPAMMY message hit

Perhaps it can come out by increasing amavisd log verbosity…

I find useful the postfix queue ID (like 10FBD8C0226); it is a backward search in /var/log/maillog from the delivery action to the original SMTP client.