We traced much of the increase in spam to the whitelisting of domains at user requests. For example, bellsouth.net was in the whitelist. Meaning that any email from there was allowed even if it would normally have been blocked by the spam rules. As a result, we've deleted most domains from the whitelist.
We're happy to add individual email addresses to the whitelist. Please send those to the Service Desk as they come up.