Hello there, I have absolutely identical problem as if you copy-pasted it from my logs.
Now I have simply manually changed this new directory 3.003002 to -- chown to debian-spamd.debian-spamd /var/lib/spamaassassin/3.003002 -- and I am done and it all flew back into life by running my daily crons correctly. However, this is quite new and interesting to find out that doing a manual sa-update as root changes this directory’s permissions, user and group. This is like wow! Since everybody speaks about moral here then my "5 cents" about the moral of all this is that it has to be changed by all means in my opinion. They have to choose a method and stick to that method and then accordingly and adequately reflect it in documentation. Let’s say deny sa-update by root and hard code it to be run by debian-spamd only as this is safer (I guess) and then simplify it by telling the one who runs the update right on the command line how to do it correctly if tried to run as root. The other way around approach with two existing options is fine with me as well as long as they (options) are clearly and extensively documented and do not cause any problems if run by either root or debain-spamd. I think this is also easily achievable by doing so in code. Good luck to all. Regards, Dennis.