[Exim] building a exim gateway

Hi,
I am building an Exim antispam antivirus gateway and need some advice on
the best way to complete the job. It's an Exim question.

The gateway server as of now...
1) Exim 4.34 with Exiscan, Clamav .70, Spamassassin 2.63
2) The accounts and domains are virtual using LDAP 2.1.30 and DB-4.2
3) Users can check mail on this gateway with Sqwebmail 4.03 or
Courier-imap 3.03
4) Exim tags suspected spam email subject line with SPAM and sends it on
for the user to filter and delete.

But really we don't want to deliver that suspected spam at all, but keep
it on the gateway for the user to check and either 1) have Spamassassin
learn ham false positives then send the mail to the user's mail account
on the primary server, or 2) delete the spam or allow a cron job to
delete it weekly. 2) is easy. How is 1) accomplished, ie the learning
with ham-learn then the sending to the user's primary account? Possibly
hack Sqwebmail by creating a ham-learn button? How do I let them send it
on -- this is the Exim part?

Thanks,
Craig