Re:ESVA all day long (Score 1)

+1 to MailScanner, but I would add MailWatch for administration purposes. Between this and client-side SpamBayes, my last company (where I was the sole IT admin) was able to clear out about 99+% of the spam it received, with a false positive only about every 2 weeks to a month. It's a completely open-source, free as in beer (surprisingly relevant for small companies).

The setup was servicing about 50 employees, and would pass the email traffic through to an Exchange back end. We were also able to cut down a bunch of traffic, by writing a script to output the valid email addresses on the Exchange box, and letting the spam front end take care of it.

If you didn't do this, then the spam server would accept all email to your domain(s), and then your back end server would have to deny it. This keeps the traffic and cpu utilization down on your back end server (which is a good thing).