Interesting topic.  One of the big issues we see in deploying IT solutions
is lack of knowledge,sometimes lack of funding  (partly driven by the fact
that organizations can't put a price value on services/IT)  and that
government (and other?) organisations are not (hat well managed and driven
by rationale and efficiency as is often assumed :-)

We're looking at Exchange Hosted Filtering (EHF) . One of the remarks there
we get is We need to be able to work "seamlessly" when for some reason that
services no longers works (remarks made by management range from being
blacklisted by MS hating ISP's, Armed conflicts where  US owend IT
infrastructure is also targeted, including cyber terorrism etc ...) So what
I suggested is that they implement a ETS where the mail coming from the EHF
will normally just flow trough (or be filtered again). They can add a MX
record with lower priority as in a backup mail server or mal relay queue ...
I know could lead to the lower priority MX record being targeted by spammers
but that is where the Edge should perform it's filtering role. It is also
the policy that external mail must arive on a mail gateway in a perimeter.
The cost is not to high (even if the Edge will never be used) because it
give's 'm peace of mind and they get Forefront  for the anti virus as well
with the Exchange Enterprise call. They are now using Brightmail (IronPort
is the appliance version of that) and it works really well. So Exchange
Hosted Filtering and Edge will have to prove themselves. What is lacking in
Edge is reporting. A big plus of Brightmail is also is easy of use extreem
low false positive ratio.