I use SpamAssassin in a prequeue SMTP proxy and it works pretty well, but it's nearly the last check after many other lightweight tests.