I think that the problem is that my auto-whitelist database is actually kept in /private/var/CommuniGate/Settings/SpamAssassin/.spamassassin/ and not in /var/root/.spamassassin
You've got a basic problem of having different home directories.
You need to run your commands as the same user that CommuniGate is running as, and not as root.
Worst-case, you can create a dummy user who's home directory is there and su to it before running your commands.
