We spent the last year doing the same thing and are down to about 400 XP machines out of 110,000. Why 2003? Here is why we didn't
1. Too much inhouse custom crap on user machines to go through the testing cycle to make sure it worked with 2010. Which equals more money spent
2. We are moving users to Windows 7 in a short time why go through Step 1 for practically no gain
3. We have enough protection on the desktop and procedures to not worry about an infection spreading if a machine was hit. Essentially things are locked down enough and monitored enough not to worry too much.
4. Great motivator to get local admins to start moving their users when they are bitching that they want Office 2010.
Organization that big, stability is key and changes are a big deal. We had to pay for support last year for nearly 60,000, now it is a handful of critical machines that can't be migrated due to software yet.