We use Forefront Protection for AV/anti-spam scanning (previously used TMG as well). With FPE, you can create custom rules based on keywords, embedded links, originating domains, etc to help weed out spam email. It takes some administrative overhead, but
it works well enough since spammers are getting pretty good these days. There's also a hosted Forefront solution I believe, as well as many other 3rd part solutions that tie into Exchange.