Have a look at GWguardian (messaging architects). I've seen it at work at Novell and it's very nice.
One thing we've done here (not novell!) for a number of years is run Mailsweeper (Clearswift) as a proxy server. It allows granular policies for email, multi-domain routing, attachment stripping, A/V integration, etc and is inexpensive. Perhaps best of all, they license per # of email users, not by server so you can build 5 if you wanted to (for resiliancy) Having a proxy is also nice bc if you take GW down for maintenance or whatever, you don't lose any email. It just caches on the proxy. Also prevents any direct connection to your mail server from the net (breaks relaying naturally..)
Another great hosted solution is edox which uses Brightmail and human email scanners + honeypot addresses to keep their filters current. The barracuda devices are supposed to be very nice (they're spamassasin based linux appliance if I remember right).. lots of potential solutions out there. I would not want to host email servers without some kind of protection though.
