Hi, everyone,
Here is an update on my project. I eventually went for the NOD32 (server edition) from ESET. I never used the PC edition but I used ESET's online scanner a lot and liked it. So far everything work wells.
As far as I know, Windows Security Essential does not work on a Windows Server and MS did that for the obvious reason. Before using NOD32 I used one workstation's Security Essential to scan the shared folder on the server. Certainly this cannot be a long-term solution.
Regarding the Spam solution, Gmail is my email service provider and it does a really good job on it.
Thanks for all the inputs.