Sorry, that was a bad question
In that log, it seems that the dovecot delivery is called _before_ dspam :)
Received: from dspam by mx.lionserver.co.uk with dspam-checkedid 1NivFH-0002cx-G5 for email@example.com; Sat, 20 Feb 2010 19:44:07 +0000
dspam definitely gets piped the mail, but doesn't seem to add headers :)
To use a transport_filter, does the relevant user need a shell?
It seems not, from the manual