I use SME as the firewall to our LAN, with it acting as a spam/virus filter for an Exchange 2000 server inside the LAN.
With SpamAssassin, using RBLs, many emails are blocked outright so you won't see those, but those that make it thru can all be saved to disk with a setting in Exchange. Then non-deliverable mail is placed in a folder. All legitimate mail, even spam, is passed on to the user, of course.
If you want to capture all mail, dont use SpamAssassin's RBLs, and let it all through. Just those infected and captured by ClamAV will remain on the SME server.
When you fill in the IP address of the 'internal mail server' in the e-mail panel, no mail is saved on the SME server, except those in quarantine...
In Exchange 2000, its Exchange System Manger>Global Settings>Message Delivery (properties)>Filtering Tab>Archive Filtered Messages.
Id recommemd selecting 'Accept messages without notifying sender...' on that same Filtering tab, unless you want a lot of queues unable to deliver messages to those fake spam addresses.
And you may have to enable the filtering on the Default SMTP virtual server.