What about the spam sent by the big email providers? It's a really interesting question what to do when you get -recurring- spam from these. (I get an offer for "Sun Microsystems User Lists" once a month from a chronic spammer sent either through Gmail or now Outlook. I report them to the abuse@xxx, but they keep on coming.) Do you blacklist a chronic spam source, that also has legitimate users? Do you quarantine everything from them, placing the burden on users/administrators to inspect and release legitimate mail from quarantine?
There are certainly lots of IP addresses that can be 'safely' rejected. Unfortunately, the growth of outsourced email makes it increasingly hard to depend on DNS information for sanity checks (e.g. there's an MX or SPF record that associates the "From" domain with the domain actually establishing the SMTP connection.)