I am perfectly fine with leaving out complex server-side spam filtering, though I suspect that some basic blacklist usage would be a good idea. Most specifically, I don't want to add the security liability and m caintenance requirements of a typical "default" server. (Apache, PHP, MySQL, Bind, etc.)
Basically, I want an ultra-basic server that I can set for automatic updates and let it continue running "hands-off" until CentOS 4 is no longer supported with security patches.
Have you looked at ASSP? http://assp.sourceforge.net ??? It does all kinds of protection and sits in front of your mail server.
Barry