Domain wide spam filtering services that filter all of your mail and relay it to your server is the way to go. I've always used a service called Appriver SecureTide (
http://www.appriver.com/secureTide/system-overview.asp)
and another quality service is Postini, recently acquired by Google (
http://www.google.com/postini/index.html).
Appriver reduces up to 85% of all the mail delivered to some of the domains I've set it up for and if your server goes down the mail is queued up until it's back up again. Also, you can block all delivery to your server except from the servers at Appriver or Postini which stops all back door spammers from hitting your server from it's IP rather than from the MX record.
http://support01.appriver.com/KB/a39/limiting-inbound-smtp-traffic-except-from-apprivers-servers.aspxI'm sure there's other filtering services that are similar. This is the two quality services I'm familiar with and have had great success. Out of several hundred PCs I've only had 1 virus infection since instituting this type of service.
