postini - brightmail, several others outside services that use multiple spam and a/v filters. may be the best way, probably not cheapest per user. but you make up with never having to fool around with spam filters, users with way fewer viruses / trojan, etc, so save alot of admin time.
you simply point your server to pickup email from the outside service, which get the mail from end users.
I'm sure there'll be those who disagree with me and want to wrestle endlessly with spam filters.
we have a barracuda spam appliance. we still get obvious spam 'mentions Oprah with !' is in a rule barracuda appended to a recent spam I got. I'm not sys admin for this. It ranked 2 points for this rule. spam would have to reach 7 points for me not to get it. so I still get obnoxious spam and net admin hasn't set it correctly to filter them. (it may be blocking many I DON'T see)