Using postfix, postgrey and dovecot here.
In practice with the number of users you're thinking of postfix doesn't
need to use a 'proper' database and using hashed lists of domains etc
will do fine.
I use postgrey to do the greylisting - for everyone except a couple of
Exchange-using idiots who can't set it up properly - and because that's
so effective at reducing spam, I don't bother with spamassassin. Or a
server-based AV.
The combination of those two decisions cuts down the memory requirements
quite nicely. A small bash script adds new domains to postfix's lists
when required.
The biggest pain is keeping track of the big boys' attempts to reduce
spam. This meant installing DKIM and pestering them a lot before Yahoo
would accept mail from my servers again, for example.
I also haven't found a webmail that I am really happy with so I'm afraid
I forward copies of everything to Gmail accounts.
Ian