I don't have the numbers with me, but yes, there is a justified cost to what spam will cost a business, and it's somewhere in the range of $300 or more per year per individual employee, as an overall cost to businesses.
That includes additional hardware, it includes lost time from hitting the delete button or hitting the report spam button; it includes the productivity loss. It also includes just the infrastructure needed—extra bodies of support for that infrastructure, if you need an additional IT resource, or something like that. So there are justifiable costs.