The administration guide is quite clear - smg_10.6_administration_guide.pdf page 317:
"You can change the amount of time spam messages are kept before being deleted."
Besides the docu lets take a look at the settings:
"Days to store in Quarantine before deleting" (Spam, Quarantine Settings, Spam Quarantine Expunger)
Regards
Thomas