I hate to bug the list for what is probably a dumb question, but is there any situation where an unauthorized user needs to connect to port 587? I'm wondering if there is some oddball "edge" case.
My thought is to use my ipfw table of known trouble makers to block 587.