How to not relay already marked spam bounced by sub-domain mailservers

[Joachim Holzfuss]

Hello,

we are having a central mailserver accepting, scanning and relaying
inbound/outbound mail for several departmental mailservers.
Every spam detection puts the mail into an attachment and forwards it.

Now: The departmental mailservers are sometimes equipped with their own scanning 
procedure and sometimes send bounces of not accepted mail back to the falsified
sender (via my relay), also their users may .forward their mail to other
(outbound)destinations.

How can I stop the main mailserver from sending out these already scanned,
positively watermarked and spam marked mails. 
Can someone think of and share with me any mixture of rules in the conf files
to accomplish that?

Thanks
j.h.