Looks like spamd gets into an endless loop (maybe waiting for lock).

$ ps axuw | grep spamd
exim     11178  0.0  1.7 16584 9152 ?        S    17:13   0:14 /usr/bin/spamd -
d -u exim -a -x --virtual-config-dir=/iron/mail/spama
exim     13595 46.1  2.5 18608 13152 ?       R    21:08  41:47 /usr/bin/spamd -
d -u exim -a -x --virtual-config-dir=/iron/mail/spama
exim     17633 29.5  2.5 18496 13036 ?       R    21:31  19:47 /usr/bin/spamd -
d -u exim -a -x --virtual-config-dir=/iron/mail/spama
exim     20040 25.3  2.5 18552 13224 ?       R    21:45  13:40 /usr/bin/spamd -
d -u exim -a -x --virtual-config-dir=/iron/mail/spama
exim     22678 23.2  2.5 18512 13144 ?       R    21:59   9:07 /usr/bin/spamd -
d -u exim -a -x --virtual-config-dir=/iron/mail/spama

Then, I have to manually kill those processes.
When it happens, usually it's for the same user (on different machines too):

$ sudo tac /var/log/maillog | grep "\[20040\]"
Sep 15 22:43:08 carp spamd[20040]: server killed by SIGTERM, shutting down
Sep 15 21:45:03 carp spamd[20040]: processing message <2W846t9mtA5c5
$yuE53sS1fu4pe1Ud4@jazzandjava.com> for nanclar@iron.com.br:79.
Sep 15 21:45:03 carp spamd[20040]: Using default config for 
nanclar@iron.com.br: /iron/mail/spamassassin/iron.com.br/nanclar//user_prefs

$ sudo tac /var/log/maillog | grep "\[22678\]"
Sep 15 22:43:08 carp spamd[22678]: server killed by SIGTERM, shutting down
Sep 15 21:59:46 carp spamd[22678]: processing message 
<pboglghpsjrdscfplfsgmhkjpembts@bruno> for nanclar@iron.com.br:79.
Sep 15 21:59:46 carp spamd[22678]: Using default config for 
nanclar@iron.com.br: /iron/mail/spamassassin/iron.com.br/nanclar//user_prefs

/iron/mail/spamassassin is an NFS mounted volume. When I check the users' 
directory. I notice a lock file.

# ls /iron/mail/spamassassin/iron.com.br/nanclar/.spamassassin -l
total 2004
-rw-------    1 exim     exim       925696 Sep 15 22:42 auto-whitelist
-rw-r--r--    1 exim     exim           48 Sep 15 22:23 bayes.lock
-rw-------    1 exim     exim          512 Sep 15 22:23 bayes_msgcount
-rw-------    1 exim     exim        65536 Sep 15 20:52 bayes_seen
-rw-------    1 exim     exim      1409024 Sep 15 22:23 bayes_toks

# cat /iron/mail/spamassassin/iron.com.br/nanclar/.spamassassin/bayes.lock
trout.iron.com.br.24964
trout.iron.com.br.24964

But this problem persists. It does not always happens, it's intermittent. Maybe 
because of an NFS delay/timeout, not sure. But even if that's the case spamd 
should not eat 100% CPU.

Let me know if you need more information.

Thanks.
-Daniel Lafraia