On this subject, it would be awesome to have a template to email to the domain administrators. Letting them know we have disabled a user account and what to do in order to alleviate the threat and enable the user again.

What types of infections are you seeing?  I would hope that URIBL filtering and attachment type restrictions would catch most outbreaks.

I had similar problems with using Cyren for outbound scanning. I've since switched to Message Sniffer but haven't attempted to re-enable outbound scanning. I'd love to do it though.