I use fail2ban to block misbehaving hosts - like those that send too many spam messages in a row or try too many not existent users. It works by parsing your log files.Is there someone with a script to modify qmail-scanner-queue.pl or another script to run /sbin/iptables to block a spam IP address on the first flagged email, then maybe remove blocks from iptables after a day.
http://www.fail2ban.org/
