One of my main job responsibilities is admining our email system at
work, and I can tell you truthfully that auto-challenge systems (which
you seem to imply you're using) are not a good thing to put into place.
At best, you're going to tick off a lot of people who truly want to
communicate with you; done on an organization wide basis it can even
land a company's email server on a blacklist (ie, people who check the
RBL server will refuse to deliver messages sent by you).

If you want to drop the spam without resorting to auto-challenge
systems, you would do well to look into SpamAssasssin (it's free).
I've got it checking our incoming mail (along with my home mail
accounts). It uses a multi-tiered approach (blacklisting, RBL's,
content rules, bayesian analysis, online tests w/ DCC & Razor) that
does a LOT to help block it. I've also got my Postfix MTA set to use
greylisting. This combined with a freeware virus scanner has
eliminated over 99% of our incoming spam, and it's literally been
months since I got a spam message at home.

Try it out.

Mike Gaskins