Same problem here. On the normal policy setting it is now passing things that are even marked spam in the logs.
Mar 29 17:42:14 blacksun amavis: (01433-01) Passed SPAM, [184.108.40.206] [220.127.116.11] <bambikay@XXXXX.org> -> <bambikay@XXXXX.org>, Message-ID: <20090329224212.8A70CA344@blacksun.XXXXXXXXX.com >, mail_id: D69Pwx2bjIMt, Hits: 29.839, size: 2327, queued_as: 8286DA345, 1675 ms
Before upgrading to 3.0.1 from 18.104.22.168RC this was working fine and things marked spam were not being delivered.
Any ideas what we need to change to fix this? My real fear is virus infected mail getting through.