Brilliant, Till. Thank you!
Per your advice, I turned Amavis's logging level up to "2" and now I do see detailed Spam Assassin scoring data.
<firstname.lastname@example.org> -> <email@example.com>, No, score=-0.011 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Also, thanks for clarifying that I can access user mailboxes with any text-editor; great to know.