Choose your MTA
We chose exim - flexible, readable config. Others like postfix or sendmail
Consider in-MTA greylisting
If not using PF + spamd, a milter (sendmail, greylist-milter) or policy server (postfix - postgrey) is an option.
Choose your malware scanner
We chose clamav - free (GPL), quick database update. Others available, free and commercial
Choose your spam filtering
We chose spamassassin - free, flexible, active development.
Others like dspam others (free or commercial)
spamassassin offers feedback to hashlists (this message is spam) such as Razor, DCC - a few scripts will go a long way
All this used to be unneccessary :(