I'll start off by saying I'm not a cisco guy so as much as ewwhite's suggestion about PAT seems good, I can't really say yes or no to that.
Next, if the spam filter is behind a firewall I can see two options. One is using a public ip for the spam filter. The other would be to port forward the traffic from the firewall to the spam filter. Spam filters are highly dependant on seeing the correct sender IP of each email to enable DNSBL's to work, but both these scenarios will work fine.
One thing not to do is to have any form of mailserver running on the firewall that stores and forwards mail, as then the spam filter will see the sender ip of the email as the internal ip of your firewall which will seriously hamper the anti spam function. (Probably not relevant for cisco but included for completeness)
Now, backscatter is created when your Barracuda (or any other device capable of storing and forwarding emails) will accept emails for recpients that are not valid. When it tries to forward these on to say your Exchange server, that will only accept emails for valid recpients if configured right. Then NDR's are sent for all the emails sent to invalid recpients. The thing is crafty people have realised if they forge the from header (e.g if I put my personal email address as the spoofed from address), then al the NDR's will be sent to that person (e.g. my personal email address) as opposed to the actual spammer/sender.
Backscatter commonly presents when a device such as a Barracuda (or a MTA) is set up to accept all emails for a particular domain(s) without an actual list of valid users. Before you disable NDR's, check RFC2821 which says this is not to be done.