If you didn't set $final_spam_destiny and $final_banned_destiny to D_DISCARD, spam and banned emails will be delivered to user mailbox directly. And if you have below settings also, spam and banned emails will be saved in SQL database too:
$spam_quarantine_to = 'spam-quarantine';
$spam_quarantine_method = 'sql:';
$banned_quarantine_to = 'banned-quarantine';
$banned_files_quarantine_method = 'sql:';