Greylisting and DNSRBL always worked sufficiently well for me, in addition to Spamassasin.