I've managed to get my spam load down to managable proportions but there is one more check that could help.
I notice that on some of the spam that gets through both the From and the To addresses are the same (both are valid).
Can I filter out or reject all mail where the From and To addresses are exactly the same?