If you have not also enabled the spambox, the spam will not end up there, and therefor no spambox I believe.
By "only" having spamassassin enabled and default address set to :fail: (note both colons), the spam will automaically get deleted if caught by spamassassin.