Project Honeypot just published a report of their experience in processing 1 billion spam messages. Highlights for the impatient:
It appears a spambot has found one of my personal domains attractive.

Despite this, i've received no spam that has actually made it through my SpamAssassin/Thunderbird setup. The lessons i've been learning about this recently have led me to create a wiki page about it.