Can I log into your system from outside?
Basically what I need is:
1/ a complete spam report from a message that was not caught as spam
2/ even better, a spamassassin debug dump of that message being processed. That'll tell me exactly why the message is being scored the way it is scored.
3/ your dns server settings for your EFA box. Is efa passing dns queries onto an upstream server, or is your efa instance doing it's own dns queries?
When I first setup my efa instance, I also had low spam scores, and for two reasons, a) the bayes database wasn't trained and b) I was not able to use the dns rbls because I was using the ISPs dns server and the rbls were blocking requests from the isp. (most rbls are free to use as long as you do not make too many queries daily)
Also, can you tell me your how much experience you have with linux system administration? If you're an experienced windows administrator and have no knowledge of the linux command line, it makes the explanations harder to understand, and our instructions have to be a lot more explicit.