check_sasl_access?

[Bernhard Schmidt]

Hello,

I did not find it in the manpage, in the odd chance I missed it, is 
there something like check_sasl_access or check_username_access for 
smtpd_mumble_restrictions?

We just had a compromised account being abused for spamming. We had him 
on the radar before he even got his first mail delivered due to 
reject_sender_login_mismatch, but

- the central user directory is run by another department so I could not 
immediately lock down the account, would have done it with dovecot 
deny-database but then I need the username he is using to authenticate 
(which can be either the username or any associated email address here)
- I wanted to have a sample of the spam anyway, so I wanted him to be 
able to authenticate
- check_client_access = HOLD of his address would work, but spammers 
often change their sender IP
- check_sender_access = HOLD helped here but was a bit of a wild guess, 
since the account had dozens of addresses

Long story short, I was looking for something like check_sasl_access or 
check_username_access or whatever to HOLD all mails, but it does not 
seem to exist. Is this correct? Any other ideas how I can archieve that 
(short of a policy service)?

Thanks,
Bernhard