I had a problem with spam completely bypassing filtering. It turns out that 500KB size limit was coming into play. From looking at the configuration page it isn’t 100% clear to me if spam and virus filtering are both affected by the single setting.