The Official SBS Blog : Messaging Hygiene in SBS 2008: http://blogs.technet.com/sbs/archive/2009/11/09/messaging-hygiene-in-sbs-2008.aspx
According to this SBS Blog post: "IMPORTANT: In order to download update definitions for anti-spam, you are required to have either an Exchange 2007 Enterprise CAL for each user mailbox or a Forefront Security for Exchange license. If you have not purchased a Forefront Security for Exchange license before the 120 trial period expires, your anti-spam agents will no longer be updated. You will be notified in both the Windows SBS console and the Forefront Security console when the trial has expired."
I'm way past my 120 day trial and I still get SPAM Updates. I also checked the Transport Agent in the Exchange Power Shell and everything is enabled except AD RMS. Did they have a misprint?