You're not doing anything wrong, this has been troubling us for some time. The mailspam, mailgood and copied databases are being redesigned and should be ready for release with a new version of kSpam in the new year.
In the meantime, you could try copying the denied message to an internal server's mail.box, as long as the message doesn't pass through kSpam again it won't have a problem; this bug is addressed in the next version.
Rgds,
tom