The way bobf did it here was to bind a different rewrite onto
/mail/lib/rewrite into smtp's name space (in /rc/bin/service/tcp25)
that queues everything into a queue for scan mail:

% cat /rc/bin/service.alt/tcp25
#!/bin/rc
#smtp serv net incalldir user

user=`{cat /dev/user}

bind -c /mail/lib/rewrite.in /mail/lib/rewrite
exec upas/smtpd -n $3

% cat /mail/lib/rewrite.in
# reject any address with a % because spammers might try to relay through us using
# it and an internal machine
.*%.*	|	"/mail/lib/haspercent '&' '\s'"

# everything else gets queued for the spam filter
.*	|	"/mail/lib/qmail.in '\s' 'net!achille' '&'"

% cat /mail/lib/qmail.in
#!/bin/rc
sender=$1
shift
addr=$1
shift
/bin/upas/vf | upas/scanmail -s -n /mail/queue mail $sender $addr $* || exit 1
upas/runq /mail/queue /mail/lib/remotemail</dev/null>/dev/null >[2=1]
exit 0