I looked at a half-dozen Postfix/SpamAssassin howtos today. Unsurprisingly, the simplest one turned out to be the one that worked. Occam wins again.