Work's ISP runs a spam filter, but it just modifies the subject line, which means the phone still downloads it.
I found a for-money, mac based solution, but I don't have any always-on macs that I wanted to run the software on, and I'm not keen on paying money to get rid of spam anyway.
But, I found a solution that keeps the phone relativly free of spam and doesn't mess with Mail.app. It involves running spamassasin on my home server and a pythion script, ISBG.
You can follow the instructions on the ISBG page to get it setup, ignore how out-of-date it is, it works fine. The key thing is the exact IMAP folder ID for the Mail.app Junk folder (so you don't end up with excess spam folders). I had to brush up on my IMAP skills and connect with telnet to find the exact folder id that Mail.app expects to find spam in. The key line is:
isbg.py --imaphost mail.host.com --spaminbox "INBOX.Junk (NameOfAccount)" --imapuser username --delete --expunge --nostats
NameOfAccount is the name the account appears under when you expand the Inbox virtual folder.
I've put it in a crontab, to run every 10 mins (*/10 * * * *), and it seems to be doing the job...