DoS lack of logs

[shuttlebox]

I have been hit with some archive that uses all the resources and
slows mail thruput to the point that the incoming queue only grows and
grows.

When the virus scanner times out that is logged and MailScanner
records a denial of service attempt but only the MS process in shown
in the syslogs. I would like the message id's of that batch in the
logs, or better yet the offending message id if it's possible.

It's now hard to find the message that causes this or do you guys have
a good way of finding it?

-- 
/peter