Hi BeNe,
Pardon the delay. I just do simple global filtering with spamassassin and clamav. Basically I do reject (so no bounce spam can happen) and have the rest go through, marked as spam.
I keep levels relatively low, and have postgrey off. It is the same for all users. I get no false positives, and very little spam gets through.
I prefer to do this because I don't want the mail servers getting bombarded with spam that has to get processed, I'd rather reject it before it comes in, and this works well.
I really think the upgrade script should just give an option to leave things alone (upgrade postfix config files? yes/no), or integrate find/replace and add (for new lines) when dealing with master.cf and main.cf files. Mail is just too customizable to wipe it clean everytime like that.
Happy to help with this implementation.