Interesting delema. I for one really need to have forward-only mail filtered. My domain has been around for awhile and all of my family members (who mainly use the forwarding feature) love (and need) to have their mail filtered.
But I see your concerns:
1) What happens to filtered spam on forward-only addresses? Where does it go? Can it be released? (I don't actually need this, see #2.)
2) Are there spam reports for forward-only addresses? At least to some default mailbox? (I do at least need this - even if the mail is not retrievable. Because at a minimum we can contact the sender.)
3) How does one set the filter settings for forwarded addresses? Does it use the default score of 4?
4) A suggestion: Let each domain set one default mailbox for spam administraiton of forwarded addresses. Use this default mailbox to get filter settings, quarenteen messages, receive spam reports for all the forwarded addresses, and allow releasing from quarenteen (to continue on to be forwarded to the correct e-mail address). That way one real existing mailbox could take on spam administration for all the forward-only addresses.
I'm guessing a work-around is to create real mailboxes for each forwarded address. Will this really work? Does forwarding-also on real mailboxes occur before or after spam filtering?
In general, I feel I need substantially more documentation on how the spam filter works. I need enough to understand what I can and cannot do. How mail is forwarded or filtered or not. Where things go in all the various cases, etc. Then I can figure out ways to deal with the screwy cases I have. As it is, I'm trying to run experiments -- but it takes time as it takes quite a while to get filtering turned on or off and create test mailboxes. I'd rather just read how it all works and go from there.