I have been receiving spam emails in my work place's mail account. That email account is strictly for internal use only, therefore the address is not use elsewhere in the WWW.

Those spam emails basically send itself to all staff's email in my company mailing list. I suspect the addresses were harvested from the my company's website specifically through the staff directory.

So what can I suggest to the IT dept to protect the staff directory section of the website from spammers' web bot?I read that one method is to use poison CGI script.

Or can they put in an anti-spam filter in the mail server?

You may consider putting in anti-spam solution to filter spam and virus emails in your corporate email server. PM me know if you need assistance.