I'm currently testing out a couple of transparent filters that will sit in front of the servers and eliminate the spam before it gets to the server. That would make any catch all settings useless. The proxy updates each 15 minutes from a list of actual email accounts on the server and will only pass mail through to those. And while it does that it skims the obvious spam off the top.
One of the anti spam devices is this - ASSP
And the other is this - DefenderMX