Not too sure what could cause them to stay in the spool, you could post a snippet of the delivery log from one of these messages with emails and personal info removed. 

However, I'd suggest against bouncing spam as this could open you up to a backscatter attack where spammers intentionally send you spam impersonating someone and then your server will bounce to the impersonated users. This could cause other receivers to mark your domain as spam. Just a heads up!

Okay, I'll just delete them then. Thanks!

Avoid bouncing spam if you can help it; doing so leaves you vulnerable to backscatter attacks, in which spammers send you spam pretending to be someone else, and your server subsequently bounces to those users. Other receivers may mistakenly label your domain as spam if this happens. You should know this.

We had a spammer apparently use one of our clients as a spoofed address and back scatter us.. All of a sudden we had 60,000 emails coming in to our server all bounces, all going to the same person. I would clear the spool and it would fill up again pretty much immediately. This went on for days. I had to suspend the user account for a day to prevent her from getting all of those