Yes I would guess it's time for a third-party product.
In Exchange 2007, you have much more flexibility with controlling and catching spam but Exchange 2003, as I'm sure you know already, doesn't have that.