Best anti-virus/anti-spam for Exchange 2007?

Our company is building an Exchange 2007 environment from scratch for our 500 users.  I'm researching anti-virus / anti-spam / content management solutions.

My preference is for a something that could be installed in the Exchange Edge so we don't need another server.  Alternatively, a stand-a-lone windows server would be ok because it could easily be cloned and restored at our disaster recovery site if necessary.  I suppose an appliance would be ok, but we'd have to buy two (one for off site disaster recovery), and be able to backup & restore its config.

Question: What are the most popular solutions for this purpose?

The following probably won't format well for this post, but is some criteria I came up with for my requirements matrix:
Integration with Active Directory or LDAP aware to spare us from maintaining a separate database of users
Maximum number of mailboxes supported
Runs as a separate Windows Server?
Runs as an Appliance?
Runs as an Exchange plug-in
Total Quar. Size limit for messages held for all users
Supports different policies for internal vs. external?
Anti-spoofing (detected forged from address)
Attachment stripping (quar) and pass message through?
Bayesian filtering (HAM vs. SPAM) (legit words vs. spam)
Can reject mail before it enters our network? (by size, banned domains / ip addresses)
Detect .exe's, even if renamed?
Different rules for different groups of users
HTML sanitizer to remove scripts & exploits?
Image Spam?
Lexical (key word / phrases) blocking / tagging
Multiple virus engines
Quar attachments by type (video, sound, .exe, .vbs, etc.)
Query black list databases: MAPS / RBL / ORDB
Scan inbound for viruses
Scan inside zip files?  (how many levels (zips inside zips).
Scan inter-office messages for viruses
Scan outbound for viruses
SPF  support?
blocks phishing emails
Intercept mail from first time senders until they prove they are human & legit (then placed on white-list)  (wouldn't work well for mailing lists, so maybe need two separate addresses?)
Large community of humans assisting in spam tagging
Reverse DNS loookup?
Stealth response to dictionary attack to spare exchange server CPU
Encrypted emails?
Scan password protected files?
End-User web interface?
End-User white-listing / black-listing?
Spam digest by user by day?
Attachment stripping with end-user release
Could our users tag messages as spam to benefit other users in our company?
Auto purge Quar of content older than X days
Automated backup of config & database (SPAM/HAM)?
Automatic spam definition updates?
Automatic virus definition updates?
Custom templates for bounced (virus, spam, banned type)
Email header re-writing?
Limit # messages / hour (provide exceptions)
Message log limit?
SMTP authentication for 3rd party relay?
Full email (header + body + attachment) retrievable through searching?
Journaling (copy all message to a particular archiving email address)
Keyword blocking by user?
Revert to previous firmware
Single point of failure?
Runs in an array of servers?