I've pretty much deployed (succesfully and happily) our 2 Ironports, and am now in the process of doing the final touches.
We're blocking spam and all and that's all good. Hardly ever have a need to retrieve anything. We also block attachments (executables and media) and those are stored in the Policy quarantine (only option available when doing content filtering).
I send a notification out to users alerting them of the fact that they have a blocked attachment, and basically the idea is for the user to go to the Policy quarantine and retrieve the attachment if they need to.
For the spam quarantine I can configure an LDAP lookup to AD, but not for the Policy quarantine. Setting up each user on the Ironport is not an option, we currently have 2400 odd users worldwide, so any other way I can get this going?