I found a strange problem on Exchange 2003 with Intelligent Message Filter (IMF) disabled on SMTP virtual server. Despite the fact that GFI's MailEssentials was installed on the machine and that IMF was disabled, IMF was still doing most of the antispam job.
If I for example changed the default action on Intelligent Message Filter tab to Archive then I found lots of spam in the default IMF archive location \exchsrvr\mailroot\vsi 1.
When I opened MailEssential's Monitor tool it was obvious that only "clean" messages were passed to the MailEssentials.
So what went wrong? Somehow IMF enabled itself despite that checkbox on SMTP virtual server was not selected at all.
To resolve the issue just open the SMTP virtual server instance, enable IMF by checking the Enable Intelligent Message Filter, restart the SMTP service and then uncheck Enable Intelligent Message Filter to really disable it.
Now if you check MailEssential's monitor you'll see that spam and all mail is going through MailEssentials.