ok i investigated a little and it seem that api call counts all mails in the spam quarantine that are not completely deleted, which are all mails which fall in the spam quarantine lifetime
so we only remove the mails for real as soon as they are older than the quarantine lifetime, reason being that one mail can have multiple recipients, making it hard to track, and also
all valid spam reports (those not older than the lifetime) have valid deliver/Whitelist/blacklist/delete links...
That helped a lot. Backround: All mails with compressed attachments are moved into the quarantine. So the it deparmend has to be informed when a new mail is in quarantine. For monitoring we use Zabbix. So my new item looks like this: