A combination of DNSRBL, SpamAssassin, and using different localparts for each service is working very well for me. Some spam is still getting through, but not enough to feel (heh) spammed, and amazingly I haven’t had any false positives from SpamAssassin in years.