> Apart from the IPTables a more autonomous fix could be done with the > (improper ?) use of Anvil. Any more than X connections in a couple of > minutes and goodnight sweetheart.
This is generally strongly advised against. anvil is a DoS-protection mechanism, not a rate-limit tool - it exists to help prevent runaway conditions. If you attempt to use it for controlling "bad behaviour", it'll bite you when you start getting a lot of legitimate mail from one source (eg. qmail is known to make one connection per recipient: http://www.lifewithqmail.org/lwq.html#multi-rcpt)
