Yes. All incoming messages - except messages from domains and email addresses on your white-list - are scanned by Spam Assassin. White-listed address - as opposed to black-listed ones - are assumed to always be legitimate, as they have to be entered manually into the white-list and therefore must be legitimate.
Note: E-mail addresses belonging to your own domain are automatically white-listed, and are not therefore scanned by Spam Assassin.
