Procmail's regex dialect doesn't support the repetition operator. You will simply have to spell out the pattern in longhand (maybe use a variable if it gets too massive).
:0D * ^To:.*.[A-Z].[a-z].*[A-Z].[a-z].*[0-9][0-9]([0-9]([0-9][0-9]?)?)?@example\.org !spam
As an aside, you should not use locking on a forwarding recipe, a trailing wildcard is useless, and the h
flag is the default; so I took those things out.