I would make use of some DNSBLs at the MTA level, as there are a number of them that are discriminating enough to use as straight blocklists. b.barracudacentral.org as a start. Some of them will overlap with the default spamassassin rules, but that shouldn't matter. (I'm thinking it might be worth it to deactivate those rules, though, to cut down on the number of DNS lookups.)
And in addition to the wiki page, this thread may be worth a look:
[SOLVED] SaneSecurity ClamAV or FuzzyOCR SpamAssassin Plugins