I agree, but I don't see an alternative to have this kind of setup, where mail over a certain threshold is rejected (resulting in a notification of the user in case it's a false positive, yet without generating backscatter) and the rest of the spam delivered, modified, to a user-spam maildir.

If I understood correctly the rest of this thread, at the moment it is not a good idea to modify the message even once, within a courierfilter. So it wouldn't be possible to save a modified copy, which is desired in my as well as in other setups.

The only, quite ugly alternative I see here: checking the message for each recipient within the courierfilter, rejecting it above a certain threshold, and below it, saving the checked, modified message copies in a temporary directory, storing it's ID in a database (for example), and then using a script in maildrop to "recover" that modified message upon delivery. But I think such a solution would really be torturing Sam's work even more ;o