Data protection not working as expected.

The testing performed was insufficient to trigger the Data protection. Only a hand full of social security numbers were used during testing. The default rules specify a minimum of 10 in order to trigger the rule.
As to the second part of my question, Support informs me that it isn't possible.

The number necessary to trigger can be changed in the backend, but it is unsupported and would violate the Support Agreement for paid license users, so I won't tell you exactly where this can be done, but it's in an xml file called PredefinedContentControlLists.xml. For each rule, there's a "quantity defaultValue=". Not too hard to find buried in the chroot-smtp directory. Keep in mind:
1) The above warning about your support going bye-bye.
2) By lowering the quantity, especially to 1, you will be greatly increasing the likelyhood of false positives, given the simplicity of the built-in regex used.
3) Any Up2Date which patches the SMTP proxy will most likely overwrite the file, undoing your changes.

I never quite understood the rational behind setting the quantity numbers quite so high. With the example of SSN, if you are at a facility which is covered by HIPAA, if even one leaks out, you're hosed. When I was supporting the Sophos Email Appliance, which is where this came to UTM from, it was a major irritation of a lot of customers.

You're much better off creating your own custom CCL, where you have total control of what it will find, which will trigger on one instance. See www.sophos.com/.../117322.aspx. The other advantages to this being that Custom Rules through WebAdmin are completely supported and will survive Up2Date. :)