So (I'm guessing) it works like this:I point all MX records to this new box running a virus and spam scanner, right? After mail gets scanned, can it forward cleaned mail to user accounts on any number of servers? Do I set up these forwards on a user basis (time-consuming) or a domain basis? (better)
Yup. That's what we do. Very easy to do in Postfix, using the "Transport" capability.
/etc/postfix/transport: blah.com smtp:[192.168.1.5]