ITS uses a software product called PureMessage (from Sophos) to filter and mark the "spam?" messages.
PureMessage adds "spam?#" at the beginning of the subject line for messages with greater than 50% probability of being spam. This makes it easy to identiy potential spam. Multiple "#" characters are inserted as the spam probability increases. For example, a spam probability over 50% receives one #; over 60% probability receives two #s; and so forth.
Additional headers are included in messages with a greater than 20% probability of being spam. These headers provide more detail about the spam content as well as allow a greater degree of filtering. The spam headers can provide some hints as to why a given message was marked as spam.
Occasionally, a spam message will slip through without being flagged, because spammers are constantly coming up with new ways to "beat the system." The reverse is also true. Once in a while, a legitimate message might be flagged as spam when it is not.
See the Sophos PureMessage site for detailed information.