Look here:
http://wiki.contribs.org/Email#Internal_Mail_Servers for notes on enabling DNSBL, RHSBL, Bayesian filtering, and spamassassin on your SME server.
If you can convince your users that its a 'security measure', the easiest solution for OWA would be to use an alternate port - use 'port forwarding' to forward 8000 to port 80 on your SBS2003 server (and/or port 8443 -> 443), then tell your users to access webmail at
http://my.smeserver.com:8000/exchange or
https://my.smeserver.com:8443/exchange. This is quick and easy, but doesn't work for ActiveSync or Outlook Mobile Access (one or the other, I forget which).
If you can't use alternate ports you'll need to try out 'Proxy Pass':
http://wiki.contribs.org/SME_Server:Documentation:FAQ#Proxy_Pass. However, Proxy Pass requires that the domain name entered is *not* a 'virtual domain', but setting up a domain for email requies that it *is* a virtual domain. I don't know if this will cause you headaches or not.
If you choose the alternate port method, you could avoid telling your users by creating an ibay named 'exchange' and putting in it a simple html redirect to the new port number...