I think the only answer is a good multilayered approach. Use a couple of good RBLs. Then make sure you are doing all the checks on headers etc. Then into spamassassin. The next step is to use fail2ban, so that any particular IP can only be used by them a couple of times before being blocked at the firewall. This has limited usefulness tbh, because they are not using their own machines. What I have done is to research addresses and found that there are certain ISPs that keep appearing in spam but not ham. I then log and block them.
It is a bit time intensive the last steps, As always, it's a trade-off