This is for a small home health agency, about 25 users. There's no in-house mail server. We are contemplating moving their website and mail to an ISP that polices SPAM better at their end, but want to explore other solutions first.

Most use Outlook 2003 but nearly a third use Incredimail - this is an almost all female office, and they like the stupid smileys. Would like the solution to be under $1000 (which rules out Barracuda), and not add complexity to their VPN configuration (which may rule out Fortigate and similar gateways).

What's working for you these days?