Well, I just said that. Since what is predicated is one of two tokens <is-spam>, <is-not-spam>. Since spam is not made out of those tokens, it doesn't generate spam.

(Even spam could be encoded into those two tokens via binary or whatever, it still wouldn't because it's predicting a classification, and not the next sybmol; i.e. not simply the next bit in a after a string prefix, but a 0 or 1 value indicating whether the bit string is spam, which comes from an asserted external judgment.)

It's all the same sort of thing though: some functions trained to predict a value associated with an input.