None of those options cover what we do. We require SMTP authentication to send mail through our mail servers (and TLS to protect the passwords, of course), which has so far proven effective at stopping any bots from sending spam through our servers. We don't do outbound port 25 blocking, so direct-to-victim spambots could conceivably do some damage. But we have a good security group who spot and quarantine compromised systems very quickly.

Since we're a university rather than an ISP, our only "customers" are students, faculty, and staff. Therefore we don't often have users who go rogue and start spamming. Those who do get caught pretty quickly.

Our biggest blacklisting problem has been from AOLusers who click the "this is spam" button on legitimate mail that happens to come from or through us.