There is no other "connection from" line from that IP.
> How would you fix up Exim to handle someone doing real reconnects, a new
> session each time?
Good question... But I don't think Exim can remember information between
connections, can it?
I do have measures in place using the Linux kernel, where I block someone
if they send lots of SYN packets. This helps prevent against someone
opening too many connections, someone slamming the system, and confuses
the portscanners. This user was not blocked, because they slammed the
server in just one connection.