For Brightmail we pass a verdict to the mail server and the mail server takes the action. If there is some latency as to when the mail server received the mail and then decided to take the supplied action, this can happen.
Change the server logging to notices within Brightmail and see what verdict we are supplying to these messages and then see what action we should be taking in the first place. It could be that we are just giving a delete action for spam but the aforementioned issue is being seen.
Thanks!