Spamtrap/hamtrap seems to be the most adored service but also the least well documented one. Sending spam to firstname.lastname@example.org does not work in my installation. It is bounced with the error message X-Postfix; mail to file is restricted.
I've enabled spamtrap as the virtualmin docs requested. Virtualmin creates a spamtrap postfix alias like spamtrap-domain.tld: /var/virtualmin-traps/spam/1234567890. Privileges on those files are root:root 0666. So that should not be a problem. Apparmor does not show any restrictions.
Hope someone has a clue, thanks!