My idea is always do one thirds of everything - one third of time to contact spammy website owners to remove them, one third to have a fresh list of disavowed links and one third of building quality, healthy and great links through user help, great content, excellent services and such. Third part is the most important! I've seen from some cases on the web where websites had 300-400 spammy link domains pointing to them, algorithm penalty, rankings dropped, website owners and webmasters taking a complete turn in content creation, service creation, where the sites recovered and ranked on top pages for several keywords later on.
My thoughts are always make a website for human beings and provide a useful product, service, article, idea or whatnot. It will then help a great deal to make a website which garners tons of healthy and natural links since people find your site helpful and amazing. Nothing else is needed.
A link portfolio of a few hundred spammy links is what most sites come with these days. Unfortunately how ever Google and a ton of experts say negative link building is not that common, it really does get around in some highly competitive niches. Google has released the disavow tool just for that and it should definitely be used if you experience problems.
But bear in mind, Google devalues some spammy links with their ongoing daily procedures. When a website has 10-20 healthy links and 100-200 spammy ones which get devalued, rankings drop. Not just because there's a penalty, but because there simply aren't that much high quality links to start with.
Hope it clears it up somewhat. Thanks!