Yes, it is possible to "filter" spam, but ... the methods have nothing to do with your firewall configuration.
PF, as you know, filters -packets- by rules related to framework (IP address, flags, protocol, port for TCP and UDP), and by state. It does not inspect data within the packets. Nor can it interpret any number of packets, assemble them, and interfere with communication at higher level protocols (such as SMTP, POP, or IMAP).
There is a built-in
greylisting tool called
spamd(8), which is used to reduce, but not eliminate, -incoming spam- from botnet sources, but incoming spam to a mail server, -not- to a workstation, and you are not running a mail server.
There are any number of tools that can be installed on your workstations, or, on your server, that can help the workstation mail clients -inspect- incoming mail and help classify the mail and then dispose of it, deposit it in a particular folder, or pass it through normally. These tools must be -integrated- with the mail client software being used. One popular tool for this purpose is
SpamAssassin, which is in the Ports and Packages system as
mail/p5-Mail-SpamAssassin, but there are many other options.
(If your are permitting outbound traffic for destination port 25 (SMTP), and are -not- restricting it to specific mail server addresses, you are not preventing your workstations from spewing spam in the event they are ever taken over by botnets themselves.)