Each email is ranked through a complex algorithm as it comes in and if the ranking exceeds a particular number then the email it put in the spam folder or discarded, depending on settings.
You can turn on Apache SpamAssassin in the control panel (Email > Apache SpamAssassin). You may want to disable auto-delete of spam so you can check the accuracy of spamassassin. It has been around since 2003.
I would disable Spam Auto Delete.
I would keep the spam score at 5. It works well.
Nothing to configure under SpamAssassin Configuration.
I would enable Spam Box. SA will put spam it finds in the folder 'spam' in webmail. The folder spam needs to be created and subscribed to.
You can set up a spam folder for each webmail address or create an account-level rule to put all spam emails into one spam folder, usually the default email address.
Create spam Folder
go into webmail > roundcubemail and click on settings > folders then the + at the bottom. Enter in spam in lower case and click save. Make sure there is a check mark next to it. Click on roundcube icon in upper left. You should see the spam folder. This should start filling up with spam as SA finds it.
For All Mailboxes
An account level filter can be set up so all spam, regardless of the email account, will get put in the spam folder of the default email account. You do not have to set up each email account.
Create a spam folder in the default email account.
Click on Account Leve Filtering > Create a new filter
Filter Name: All Spam
Spam Bar contains +++++
Deliver to folder spam
Check the webmail's spam folder periodically for misclassified emails and clean out the folder.
SpamAssassin Spam Box is enabled/disabled in WHM.