X-Ham-Report is confusing users

Exchange users are getting the X-Ham-Report:

 Spam detection software, running on the system "fooserver", has identified
 this incoming email as possible spam. THe original message has been
 attached to this so you can view it or label similar future email."

It seems to be limited to emails that have just barely missed the mark for spam detection. Content analysis usually shows that the spam score ranges from 2.4 - 3.4 (in this sample of emails) when a 2.0 is required.

Of the 9 samples I just received from a user, 1 is legit (from hover.com) and the others are trash.

I would like to funnel these into a specific folder in exchange. How can I do that? Or, in the alternative, how do I tell Spam Assassin to just stop sending them?

Edit: Spam Assassin устанавливается на почтовый шлюз Debian 8 Linux, который принимает почту из внешнего мира, фильтрует ее и пересылает на сервер Exchange. Это, наверное, важно здесь.