Even if the anti-spam feature is enabled, there is still an added option to enable Anti-Spam Updates that contact Microsoft for periodic spam signature updates (does not happen by default... or without a price; more on that later). It's located at Server Configuration >> Hub Transport >> Action Pane >> Enable Anti-Spam Updates. However, you will need one Exchange Enterprise CAL for each mailbox that is protected, and AFAIK there is no option to only protect some mailboxes. It's all or nothing and they're $15 with my non-profit discount. I can only imagine how expensive they are at retail pricing.
Furthermore, you might want to look into using a DNSBL. You can add those at Organization Configuration >> Hub transport >> Anti-Spam tab >> IP Block List Providers. I use zen.spamhaus.org and combined.rbl.msrbl.net which seems to do fairly well.
However, at the end of the day, nothing beats a real, dedicated anti-spam system. In spite of all the aforementioned built-in Exchange tools, I'm looking into using Postini for my filtering. Too much spam makes it through. You may have to look into a service like that or purchase an anti-spam filter like GFI MailDefense or get an appliance like a Barracuda.