> manually approve every customer to ensure our entire CIDR ranges are clean

This is probably a key element of good performance. To keep my mail admin duties part time I simply whois the IP of evil senders and drop the resulting entire CIDR block into the our local blacklist.