You might actually take a look at (or post for us to take a look at) the spam headers for a couple of the messages that are getting through. There could be some very revealing stuff in them. Two of the worst offenders in my short experience have been something called the auto-whitelist (a negative AWL score in the header) and the bonded sender program (bsp or bondedsender in the header). A negative score from either of these can ruin all the good work you have done tuning your other filters.
The other thing I had to do was to increase the Bayes scores above the defaults--my philosophy being that I don't really care what other people think is a legitimate use of the term "Spam:" if my users think it's spam and they tell my filters it's spam, I'm bloody well gonna treat it as spam unless it comes from (1) my boss, (2) me, or (3) our vendor.
But then I'm an ornery cuss. . .
Cheers!
Dan