have you tried spamassassin?
Don't follow this advice. SA has become so slow that it's almost useless. On a VM with 1GB RAM, it takes anywhere from 15-60 seconds to process a single e-mail, and is an incredible resource hog. I've been running SA for years, run the latest stuff, and have pretty much done every tweak imaginable. And the default rules are about useless now as well: The scores are set so low that you have to set a low threshold, increasing your false positive rate. About 50% of the mail on my mail server (personal use, maybe 200-300 inbound messages a day, 90% spam) just gets passed due to spamd timing out.
Unfortunately, there appear to be no decent alternatives out there. Greylisting is nice, but spammers are wising up to it, and simply resend spam. There was a time about 3-4 years ago that zero spam came through (same inbound volume)...now, it's more like 5-10 a day. Not that I'm complaining. My point being that switching over to SA will not solve any of the submitter's resource woes with procmail.