Craig Sanders expresses his tough love philosophy:
i can't post any of my investor spam rules here because it wouldn't get past my postfix filters, but you can find many useful anti-spam regexps at http://taz.net.au/Mail/
note: i do not have time to answer any questions about them. if you don't understand them, then don't use them.
I'd try the Spamassassin Rules Emporium before somebody's private rules, as the SARE rule sets are well documented and tested against a pretty big corpus of SPAM and HAM before release. The later is nice for determining false positive rates. --We don't use rules with FP of 1% or greater.
http://www.rulesemporium.com/A nice tool for keeping your SARE rules up to date is rulesdejour, also available on the rulesemporium site.
I'd also look at using Spamassassin 3.1.3 or 3.1.5 from backports.org , testing or volatile. The latest versions of SA include sa-update a good tool for keeping the core SA rules up to date.
3.1.4 requires a patch/upgrade to amavis which might be a pain if you are using the Sarge Amavis
Enabling the network tests (DCC , razyor, pyzor, RBL, etc) is a huge help (check conf files). This is the most frequent advice on the SA listserv
Finally, as others have observed, keeping your Bayesian database trained up is important. You should run sa-learn against the SPAMs that get through and an equal or greater number of hams.
Y