I am getting into this as well.
I suggest making a spam & ham directory somewhere on your PMG. For example,
/root/bayes/spam/ → phishing, scams, junk
/root/bayes/ham/ → legitimate business mail
You need to start saving .eml files of spam mails and legitimate emails and then SCP/SFTP...