Threats of violence and service termination does wonders.

Seriously, I focus on NOT opening email from senders not in an address book or clicking on links from unknown sources. I have a sandbox available for users to open suspicious mail. Clicking on links remains an issue, but loss of access privileges carries a strong message.