If you're behind a router, there's very little point buying firewall software.
AV is important, though those careful need not even have one, i do of course for peace of mind.
Spam usually originates from companies passing out your email to other 3rd parties. As such i have 5 different addresses for different things. So be careful who you provide your email to or have another account just for registrations and the like.
You also have bots that trawl websites for emails, so don't post your email on a public website/webpage, such as this page you're looking at now.
The only spam i receive is from companies i buy IT hardware from trying to sell me for stuff, i just use filters to plonk it in the trash.
I had to abandon an old email address for spam reasons. I know various friends and family that get tons and i do mean tons of spam, and i try to educate them, but alas they get lazy and plonk their email into any website that asks for it, resulting in more spam.
I have 1 email purely for personal use - no spam
1 for purchases - if i buy on overclockers for example
1 for ebay - rarely use that now
2 hotmail accounts for random stuff, i let hotmails junk filter deal with the bulk of the junk that way. I use these for registrations and the like.
a lot of websites will ask for an email address to provide content, in some cases you don't have to activate an account, so there's no need to give them your real email, they're only gonna send you rubbish. The forms will typically check to make sure it's a valid entry though, so just putting ' blah ' would fail, where as
[email protected] would be accepted as it's in the correct format.
Pay attention to where you post your email and who you give it to and you'll not get so much spam. If you have piles of it already, i'm affraid it's pretty much too late and your email will likely be circulating masses of companies that want to sell you stuff.
Basically the way i have my emails set up allows me to determine how a given company come to have my email address, unless of course it's hotmail, but as i mentioned i expect crap to arrive there. If i get crap on my main (ISP) email i can narrow it down to set few places i have given that email and check their terms and conditions and confront them if i feel they've illegally passed along my contact details. It helps to also read such terms of a given website or company > before < giving them your email address.