Another one to look at is Mailscanner
http://www.sng.ecs.soton.ac.uk/mailscanner/
Buying the book is the way to go if you want to implement it - the online docs seem a little messy to me. However iirc Mailscanner has its limitations in terms of the docs when coming to give users individual settings (iirc it's all there but not documented terribly well).
Recently I've been playing with Postfix + Amavisd-new + SpamAssassin + ClamAv which works nicely tied to OpenLDAP or MySQL.
Exim sounds like a good option though from what's been said above.
There is a need for an open source 'm0n0wall' style app that could bundle all this.