OK, here's the howto:
1) Modify /root/ispconfig/isp/conf/procmailrc.master to include a "per-user-procmail" file by adding this line to the end:
You do not have to use ".custproc.rc", chose any file name you like. This will make procmail include every user's custom recipe file.
2) Delete the forward in the ISPConfig web interface
3) Add the following to the user's ".custproc.rc" (or whatever name you chose):
Like this you can provide accounts that are forwarded, but also spam scanned.
Another option: if you want to keep a local copy in the user's mailbox, make the first line in the .custproc.rc
The only difference is the "c" after the 0, which make procmail deliver a copy to the remote address, not the mail itself.