I've spent a lot of time on this today.

Thus far I have a spamassasin_server service within puppet that will enable spamassassin on any node that includes it. I have it tested and functional on hosted1 which is one of the current mail end points.

Ideally we'd run spamassassin at each of the end points, and bastion, although I'm not sure of our mail setup and whether or not that would cause multiple runs (or if that's a bad thing)

This is actually done now, just never got closed. Any email sent to an @fedoraproject.org address now gets X-Spam headers.