Sandstorm activity and spam mails

Hello everyone,

I have a customer that had a pretty good question just contact me and I have not found any post, blog or kb article that actually explains the sequence of events if a mail is put into the "spam" category. Maybe someone here can put me on the right track to some article or has the information themselves.

The question was basically:
"What has already happened to a mail, that is classified as spam? If I download a spam mail, do I have to put the mail through Sandstorm to check if there is anything malicious in it?"

I would guess that Sandstorm was at least queried somehow but I do not know. The spam mails have also not been listed in the Sandstorm Activity log.

Thanks in advance

~Chris