Ok it looks like I've found the cause:
SVN Commit 1172 (till) introduced a dependency on 'zip'.
eg "exec("cd $web_pfad && /usr/bin/find . -group web$web_id -print | zip -y $tmp_dir/web".$web_id."_web.zip -@");"
It is also worth mentioning that spamassasin in 2.2.36 requires GPG... something that the installer neglects to mention.