I would like to use the anti-spam filter option "body -> matches regex" in CPanel to filter spam with more than 40 numbers and letters without a space or any other strange characters. I assume that I would use the expression /[0-9a-zA-Z]{40,}/ to match the string, but will this command also work to see if the string is contained somewhere in the body or will it try to match it exactly?
It will both match it and search if the string is contained somewhere in the body. If you were using ^[...]{40,}$ that would be a different story. The match will only be the 40+ string of characters, but since you just want to see if there is a match at all you can assume returning anything means spam mail.