It's true that there is no perfect solution, but even a 70% solution may be good enough to "bother". We've put filters on our church's mail to get rid of porn spam sent to the pastor(!). The available filtering system is really crippled, but just plugging in a few of the better-known words have taken care of the bulk of it, without (so far) grabbing anything legitimate.

Based on that experience, I would say that ".php?" is one of the worst dirty words. :-)