BUT, in my Exchange 5.5 server (yeah I know...5.5 yuck!), we use email Antigen to run quarantines on files, deny files, and host names as well...If you get a good antigen, you can run stats and find out where things are mostly coming from, and once you know that, then you can begin to build the antigen rules.