So... maybe I missed it... but with the ISPConfig setup... how are users suppose to configure whitelist/blacklist to interact with SpamAssassin scanning?
This feature isn't available yet. But maybe you can tweak the .user_prefs file or the SpamAssassin procmail recipe. They are in each user's homedir.