spamassassin with blocking lists and bayes filtering, it's very effective once you have given it some data to 'learn' from. If you have many users with similar kinds of profiles (like company domain) then you can use site wide bayes filtering. https://wiki.apache.org/spamassassin/BayesFaq