This variable is used to tell the operating system how many incoming smtp connection
requests to accept on exim's behalf while it (exim) might be off doing other stuff
like forking off child processes or something (see listen(2) on most OS's). We upped
this from the default of 5 to 50 with no apparent ill-effects - yet - on a Sun Ultra
2, in order to overcome problems relating to timed-out smtp connections. What was
happening is that we were being hit with multiple incoming connections in a single
exim select() loop, the listen queue was being overrun as a result and we saw up to 2
minutes (including TCP backoff kicking in) before some connections succeeded.
I suppose the potential problem with having it too big is that the OS might be
queueing up more work than the application can handle, in which case it's probably
time to get some new hardware.
I don't think that this is a defence against SYN attacks; you'll still have lots of
unfinished connections lurking about in kernel space using up resource - the number
of entries will just get bigger <question-mark>.