Individual people can be smart.
However, people as a group tend to be ineducable.
The easiest solution is to not allow email and Internet access to the vast majority of employees. When you think about it, most people have absolutely zero use for the Internet in their day to day corporate work anyway, so this is no great loss. In fact, getting rid of access to timewasters like twitter, facebook, instagram, youtube, amazon, google and the like can only increase corporate productivity.
Of the remainder, tell 'em that opening and/or responding to such emails is a firing offense. No exceptions. Help the insanely curious amongst them along by setting your MTA to keep a close eye on attachments and links in email, and beg steal or borrow an extensive block list for the rest of the Internet.
More draconian (perhaps, this is work, not play-time!) I've actually had some luck with whitelisting corporate Internet access for the subset of employees who actually need Internet access. If the user can't make a business case for accessing a site, then that user can't access the site. Whitelisting is a bit of a pain to set up at first, but after the first week or so it pretty much runs itself. Try it before you poo-poo this.