This is a problem I encountered a while ago, and has started recurring again (twice in the past week). My searching hasn’t brought up other people encountering it, though.
I have SpamSieve 2.9.27 running on a headless Macmini6,2 [macOS 10.12.2 (16C67)], Mail 10.2 (3259). Sometimes I start noticing junk coming through into the inbox. When I check, my SpamSieve Mail rules (for all 4 accounts I’m running it against) are disabled, and the “Account is <Account>” match criteria has had the “<Account>” unselected. (Which came first, losing the account or being disabled? Don’t know.)
This seems to usually happen overnight, but I can’t guarantee it. I do not have any custom scripting running against Mail, although I do have iCloud’s Mail sync enabled.
Any ideas or pointers would be incredibly welcome.