We use
SpamAssassin, which is integrated in Alt-N's MDaemon software for Windows environments. I would recommend SpamAssassin, however looks like getting it working with Exchange is
possible but difficult.
I don't know much about Exchange, but is it capable of offloading the spam filtering job to
one of these?