Challenge/response is a great idea and can work extremely well if you approach it properly. See
http://www.spamdam.net for more information and a free trial. The product, Spam Dam, works almost transparently to the end user and requires only a simple e-mail response from new senders. There is NO administrative intervention required. Spam Dam pretty much runs itself, as long as the senders reply correctly to the challenges (yes, that is the potential flaw, but most people seem to reply to the challenge without any trouble). It's also very easy to check the "Spam Can" for quarrantined messages and rescue them (stuff from automated sources and people who don't reply properly).
I know from using it myself for a year and a half now that it is easily as effective as any other antispam system out there while being one of the simplest systems to manage (no admin support and very little end user involvement required).