Monitoring SASL authenticated users

[Michael]

I want to be able to monitor SASL users to get quick notification if something 
is out of the ordinary - like a spammer using a compromised account to send 
emails.

What tool(s) can be used to achieve this?

Thanks,

Michael