For detecting local users sending out spam, the OP might like to check out Richard Clayton's paper:
http://www.cl.cam.ac.uk/~rnc1/extrusion.pdf
which suggests watching failure rates makes a better metric than simple
submission rate.
--
Chris Edwards, Glasgow University Computing Service
--
## List details at http://www.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/
