There is no need to use a costly commercial anti-spam option if you don't want -- If you use redhat/centos, you can use clamav, spamassassin and qmail-scanner and bob's your uncle: antivirus, anti-spam and, if you add spamdyke to the equation, very fine-grained control over RBLS, graylisting...