Patch as submitted in #13497 does the trick. Processing 50K to 100K messages a day without complaints since 7/28. Please consider the patch for the next release and close the case. Thank you.

According to RFC2822, there must be at most one Subject: header line, but spammers tend to add a second one (or more) in order to hide tags from recipients. sfsistat() overwrites the first one found with subsequent ones (assassin->set_subject) and hands the last one to spamc, while update_or_insert() makes Milter replace the first one only (smfi_chgheader(ctx, header, 1,...). Therefore, I would like to suggest keeping track of the headers, passing the first one to spamc, and deleting extraneous one.
Note that I'm not an accomplished C++ programmer, so I'm not sure whether the proposed patch will eat your mail (or your memory, or your pet), crash spamass-milter (thread-safety?), or do any number of other bad things. Got it to compile and run, though. Please advise.