Speaking as someone who runs a commercial antispam SAAS, content filtering is increasingly irrelevant, and isn't nearly as effective as reputation filtering or bayesian classification.
It was a great learning experience, and I got to see a lot of volume. Sadly I never had enough customers to make the jump to the big-leagues, but it was fun.
(I'd do proper SMTP-time rejection, but also archive rejected mails in a database for 30 days. Letting you browse / search through the rejected stuff - just in case I made a mistake, and also to see how good I was doing.)
Even then content-scanning was not the best, but I used a lot of heuristics and I was quite proud of some of them. For example I "defeated" fast-flux hosts, via heuristics to lookup the number of addresses for a domain. Even large domains such as gmail only have 1-4 address-records, though of course their anycast and multiplexed. If you got a mail from a domain with 7+ MX records it was 99% spam.)
At one point I documented damn near everything, after I'd shut down, but it seems I left the domains I used expire. I should see if I can dig out copies.
(I used qpsmtpd as my core, and wrote a ton of glue code and custom plugins. Later the qpsmtpd-proxy was ported to javascript as Haraka - but I didn't covert my code even as I ported some plugins back.)