Spam emails appear to be coming through our Exchange 2007

We receive spam emails in the thousands every day. These spam emails appear to be coming through our Exchange 2007 Server. We do have antivirus installed that is the latest version and is able to scan the client and servers in its entirety. There are no spam emails coming through to our workstations.
There are a few spam emails that come into our server. When opened, the contents of these spam emails have no files associated with it. A test run done on Open Relays does not yield any spam email.
However, every few days, a small number of spam emails still come into our server. I don’t know if our firewall is blocking these spam emails or not. Can you tell how to make sure no spam email get through to our system? Also, is there a way for me to place a quota on the number of messages that users can send?
Thanks.
