I got a response from Sophos support on twitter. It was rather generic as they recommended the is-spam reporting feature and the standard configuration of recommended config settings. It seems to have stopped now though
I did get through to support this morning and they said they've gotten reports and that SophosLabs is looking into it. Guess we just hang on in the meantime.