Another bump, similar to those above we enabled the spam quarantine a few weeks ago and as of this morning there were about 3K messages in it. At first glance it looked like all the messages were very much spam - but when a user asked why her messages weren't delivered we found that it was in the quarantine. Figuring out why that happened (even after going through all the logs) was somewhat of a mystery. Then we found a few other known users with several messages in the quarantine - and after looking at the messages there's no obvious reason as to why/how they got there.
Personally I'd also like to see SmarterTools improve the following KB article:
https://portal.smartertools.com/kb/a2699/enable-spam-quarantine.aspx
That article should show the recommended *actual* process for helping to determine why / how a message ended up in the quarantine, not just a simple "it can be done" statement. Please demonstrate to us exactly how it's done.