A quick text picture should help


_____
     )________             +------------+                 +--------+
              )    SMTP    | OA5 Server |  SMTP or POP    |        |
  INTERNET     } < ----- > | DeSPAMing  |  -------------> | MS SBS |
      ________)            | DNSBL, SPF | <-------------  |        |
_____)                     | Greylisting|   SMTP AUTH     +--------+
                           | DNSSEC     |   (port 587)
                           +------------+


Typically the customer's SBS is behind a firewall which restricts SMTP 
(port 25) connexions to come from the OA5 Servers.

Incoming mail is directed through the OA5 servers by MX records in the DNS
where first level SPAM elimination is performed on the basis of RBL listings, 
SPF Failure, and Greylisting unknown senders (First message is given a 
"Sorry we're not ready" response --- if it's on a real mailserver, and not 
a spambot, it will try again 5 mins later.  Once a not-spam message has been 
received further messages come through without delay)

We also do a Baysian check on the contents, and a virus check with ClamAV.  
The results of the Baysian check are recorded in a new header 
"X-ASSP-SPAM: yes|no" and can be used to pre-file messages on receipt.  
We also block "Dangerous" attachments from senders who the recipient has 
not sent mail to and therefore whitelisted

The Baysian check relies in part on the customers sending mail out by way 
of our servers, and the incoming mail Baysian checks are skipped for mail 
from correspondents who customers have sent mail to.