clamav with Google's safebrowsing filter enabled blocks a great deal of junk. It eats RAM, though.

Looking in my logs, it looks like that plus a hard block on zen.spamhaus.org would be enough to remove almost all spam, though I'm not sure what the false positive rate would be like on the latter.