spam spam spam
Just a few random observations...
Up to about a year or two ago, 99% of spam was addressed using BCC. This made it easy to get rid of it - just treak all email not addressed to you (i.e. whose To: header is not your email address) as spam, bulk mail, whatever you call it.
Now, virtually all of it is addressed To: the recipient directly.
The spammers are also scanning a given IP for multiple domains; this can yield group companies etc on a common www server. They then spam from one domain to the other. This probably works since most companies will whitelist inter-group emails.
They also scan your website and pull off keywords. They then stuff these within the random text in their emails. This again works because many companies will have whitelisted names of their products.
Spamcop is now a right royal pain in the a*se. That database blacklists just about every ISP some of the time, some more than others. Unfortunately, sysadmins have not yet woken up to this and many email systems summarily dump all incoming emails if they appear on the spamcop IP database, and this is responsible for vast numbers of "missing" emails.
On a random check of the ~ 10,000 spams we get per day at work, about 75% of them would be removed if we dumped by Spamcop IPs. This still leaves 2,500 spams per day - far too many - and also dumps a load of emails from real potential customers...
We have a very good system now, which uses a combination of features, but it took a lot of doing. It is virtually certain to not lose a genuine incoming email from somebody who has never been in contact with us before.