OK I tested it today.
- Forwarded email IS processed by amavis/spamassassin.
- Ham is forwarded unchanged.
- Spam is forwarded with ***SPAM*** added to subject line.
- Ham forwarded
- Spam to /dev/null
- Option to put spam in user's spam folder.
It looks like I need to use Maildrop.
There's an example of a Maildrop filter near the end.
I think I can tweak this filter to suit my needs.
Now I just need scripts to easily setup + remove users...