We use a solution similar to AngryKilla's.

We don't have a ton of email users so we use our ISP as a relay. They provide spam/virus filtering for us by using a product from baracudanetworks.

http://www.barracudanetworks.com/ns/...m_overview.php

It works pretty good. What that doesn't catch, Outlook 2003 and 2007 do a pretty good job of. Then of course, antivirus on the client too.