Well, would an option like "max_recipients_per_mail" help a bit? I know of
companies that enforce a 10-recipients limit - mail with more recipients is
considered "likely to be spam" and forwarded to some webmaster underling
for review.
This would not help if the spammer sent 1000 mails with one recipient in a
row. A "max_connections_per_host" option would help, as well as a
"max_connections_per_hour". I do not know whether any of these options is
actually implemented in one or the other form, or whether Philip is
pondering about it.
The $recipients_count variable might be a starting point for option #1.
