It largely depends on your mailserver and what it thinks of his mail. It could be poor configuration their end, or aggressive settings at yours.
How do you receive mail ? Directly via SMTP or does the server fetch it via POP3?
First thing is in the mail headers - can you post the headers of a Spam mail please so we can have a look? That should give some clues.
You can have a look at the logs in /var/log/spamd
Depending on how you get mail the next log to search is:
/var/log/qpsmtpd/current
That has a series of archives but they are rotated pretty quickly.
You can have a look for his email
grep -ir "joe@postfix.eu" /var/log/qpsmtpd/current | tai64nlocal
or
grep -ir "joe@postfix.eu" /var/log/qpsmtpd/* | tai64nlocal
You hopefully you should find something like
2019-01-02 09:57:19.702845500 21326 dispatching RCPT TO:<joe@postfix.eu>
We can now look for the entire transaction which in this case is 21326
grep 21326 /var/log/qpsmtpd/current | tai64nlocal
Might tell us a bit more.
On top of that lets have a look at these:
config show spamassassin
config show qpsmtpd