We trialled both surfcontrol and Mailsweeper for SMTP
http://www.surfcontrol.com/
http://www.mailsweeper.com/
after testing we settled on surfcontrol. It allows us to block spam, attachments by type/size. scan for viruses etc.
It sits on a separate machine, scanning mail before it hits the mail server.
Spam scanning is done via preset dictionaries, which can be amended, deleted and added to.
S.