Are they actually receiving the virus, or just the email telling them a virus was found? So far I haven't had a single virus get through to any of my user's accounts (about 12) or on the 4 personal accounts I have through these servers.
I did have a client who asked the same thing, "Where are all these viruses coming from?" and I found out he was just seeing the "we found a virus" message. I showed him how to set a filter in Outlook to just eliminate these messages, made sure he was also running a good antivirus on his machine (he has AVG from www.grisoft.com, the free version, which is excellent!) just to have some insurance. Not a peep out of him in several weeks.