Take a few minutes to check out the headers of the mail that's slipping past your filtration.
Look for tests that are consistently hitting but not getting mail up over your limit.
You can get a full list of all tests performed here (there's three diff pages, make sure your version matches):
http://spamassassin.apache.org/tests_3_1_x.html
You then are left with some judgement calls on whether you agree with the default test point settings.
I've opted to customize the following scores.
score HTML_IMAGE_ONLY_24 5.0
score DATE_IN_FUTURE_03_06 2.0
score US_DOLLARS_3 2.0
score RAZOR2_CHECK 2.0
score RAZOR2_CF_RANGE_51_100 3.0
score ALL_TRUSTED
0.0
I'd recommend that you not make any changes without a solid history of underscoring backing your decision.
Once you've made your changes keep a close eye on what's getting tagged with your rescored rules.
It's very easy to tag legit mail as spam.
Also ensure that you'd not deleting spam, just move it to alternate folder.
This way if you screw something up at some point, your users still have a recourse.
Using whitelists also makes it a lot easier to clamp down hard on spam without increasing your false-positive count.
I'd recommend using whitelist_from_rcvd.
perldoc Mail::SpamAssassin::Conf
-steve