Has anyone done something like this for Postfix who is willing to share?
Rate limit outgoing mail based on the number of bad recipients as a more intelligent rule that won't impact regular users (intended to stop abuse of compromised accounts).
https://lists.exim.org/lurker/message/20100226.153132.58ab2e98.en.html https://github.com/Exim/exim/wiki/BlockCracking