OK, I found the solution. So the command needed for me was:
user=debian-spamd argv=/usr/bin/spamc -u ${user} -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
${recipient} returns the full email address whereas I just wanted the bit before the @ sign (the user name).
user=debian-spamd argv=/usr/bin/spamc -u ${recipient} -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}
but that didn't help.
Also, the permissions on ~/.spamassassin/user_prefs are world readable.
