If X-Spam-Status and the report in the message body don't line up, you probably have an error in your MTA setup that's causing the message to be run through SpamAssassin twice. This causes the message to be rewritten on the first run, then the second run sees a very different message so the rules hit are also very different. Double check your configuration to make sure this doesn't happen. (some examples: the MTA filters the message, then it's filtered again through procmail. procmail is setup globally to filter, then the individual's procmailrc filters as well. etc.)
Here's an example of such a mangled message (headers have been trimmed for clarity and privacy):
...