For detecting local users sending out spam, the OP might like to check out
Richard Clayton's paper:
http://www.cl.cam.ac.uk/~rnc1/extrusion.pdf
which suggests watching failure rates makes a better metric than simple
submission rate.
--
Chris Edwards, Glasgow University Computing Service