Do spam check after all other checks, as it is expensive http://virtualmin.com/node/32098