I know I can use a system filter to replace certain headers in messages, but how can I add text to existing headers? I want to add [SPAM] to the subject line of messages that appear to be spam.

You can only do this in a round about way, using filter commands like this:

headers_add "New-Subject: SPAM: $h_subject:"
headers_remove subject
neaders_add "Subject: $h_new-subject:"
headers_remove new-subject

This trick works only in system filters, where the commands are obeyed in order, and affect the master list of headers that apply to the whole message. You cannot do this with the headers_add and headers_remove options on drivers.