OT: how to block emails sent to too many recipients

[Denis Beauchemin]

Hello all,

Someone seems to have found a way to use one of our MS servers to send spam. Each spam is sent to more than 199 recipients and the envelope from is never from our domain.

I would like to block them but I am not sure how… I didn’t find anything in sendmail (except milter-limit which denies emails I have to deliver). I am now looking to SA.

Does anyone know how to get the nrcpts= value found on the from= sendmail log line?

Thanks!

Denis
PS: the spam is sent through our webmail (Horde). I cannot stop delivering emails from those servers.

Denis Beauchemin, analyste
Université de Sherbrooke, S.T.I.
T: 819.821.8000x62252 F: 819.821.8045