Ask HN: Beating spam

The startup I'm working on requires a support ticket system thats currently receiving vast amounts of spam. Anyone have any suggestions / know of any systems for getting rid of spam that do not lose legitimate emails? I've been considering grey-listing, but delaying some support requests would just make our support seem worse than it is (generally we get < 10 minute responses). I've filtered through GMail before, but occasionally their filter chokes and starts marking lots of legitimate emails as spam. I'm considering writing my own system combining other ones I find (automatically white listing known clients). Does anyone have any experience with sending human verification messages? I know occasionally I'll be sending them to email addressed faked by spammers, but I'll check SPF records before sending (and if people get annoyed it should really be their/their isp's responsibility to get the records up?)