Update: 12/19/2015
While the below settings work well for the built in hMailServer anti spam, I have since moved to ASSP on a separate server for spam filtering. It is by far the most effective solution I have ever used and I highly recommend it! As a basis for comparison, when I was using the below setup I would routinely get 5+ spam emails a day slip through the filter. Now that I have ASSP well tuned and up and running for 6 months I may get 1 spam per week that slipped through.
Antispam->General
Spam Mark Threshold = 6
Spam Delete Threshold = 9
Max Message Size to Scan = 1024
All tickboxes selected.
Antispam->Spam Tests
Use SPF = 3
Check host in HELO = 2
Check DNS MX = 2
Verify DKIM = 5
Antispam->Tarpitting
Count 0
Delay 15
Antispam->DNS Blacklists
zen.spamhaus.org | 127.0.0.* | Server rejected by http://www.spamhaus.org/zen/ | Score = 5 | (Old Settings 127.0.0.2-8|127.0.0.10-11)
psbl.surriel.com | 127.0.0.* | Server rejected by surriel.com | Score = 1
b.barracudacentral.org | 127.0.0.* | Server rejected by barracuda | Score = 4
bl.spamcop.net | 127.0.0.* | Server rejected by SpamCop.net | Score = 4
dnsbl.sorbs.net | 127.0.0.* | Server rejected by Sorbs.net | Score = 1
Antispam->SURBL Servers
multi.surbl.org | Rejected by SURBL | Score = 4
Antispam->Greylisting
Minutes to Defer = 1
Days to remove unused = 1
Days to remove used = 72
Tick Bypass on SPF