Hello Cyrus,
As far what i know about RAV it shoud sstop the bugbear virus. in my server it does it. but is there any change that user has been load mail from some other mailbox outside the network, maybe from personal mailbox "thank's to Outlook it is possible" then the virus has been exploied in network computer and rest is history.....
you should use somekind of antivirus scanner in userscomputers too to prevent thiss kind of happening again.....
-Eerikki Peltokorpi-