I’ve never had it give a false positive (ie, every time it finds something, it’s something that’s in the SFS database).
One thing to be aware of is that the API has one limitation, and you can get a match on e-mail address that doesn’t match the e-mail address exactly - SFS will identify the domain as a “toxic domain”, but the API doesn’t tell you that. Users with e-mail addresses that are from one of those domains will show as an e-mail match, but you won’t find their exact e-mail in the SFS database by searching.
The database is a community effort, so there will be a chance that the user isn’t actually a spammer but was identified by someone as a spammer for some reason. It’s rare, but it does happen (which is why SFS has an ‘appeal’ process.