For email av/spam/etc, we use a Sophos ES1000 Gateway box
(In essense, a Sophos puremessage implementation-kinda-thing running on its own hardware)
Point all our exchange '07 servers to use it as a smart host, all mail flows in/out of it. Recently introduced it to replace/bolster puremessage installations on the servers themselves. Working very very well at the moment.