Ive been running my own in house mail server for years, somewhere around 2006 I brought it online. And for years I fought spam. I use postfix as a MTA, and combined with amavis and spamassassin, the one small program that made all the difference to the point where I might only get 1 spam every 6-7 weeks was a program called postgrey.
»
postgrey.schweikert.chIts very simple, it greylists senders, for a configured time, on the assumption that a spammer or virus will only try to send a spam message to your MTA only once, then move on, it doesn't retry, but a real MTA has to retry as per RFC.