There are several things that come to mind including:
- Maybe add more RBL's
- Maybe it's the SpamAssassin config
- Maybe it's a script on the server getting abused and delivering from a web site on the same servers to local mail accounts?
- Full heads from some of the spam will help to troubleshoot the problem
- Is SpamAssassin scoring suing the default settings?
- Try adding more rule sets and block at a lower score than 5
