[exim] Must be a worm attack...

...or something like that.

At this time we are getting a tremendous amount of connections from
completely different ip-addresses that try to send emails to recipients,
that don't exist on our mailserver. Greylisting wouldn't help, because
these worms/bots/whatever open several connections. I'm trying to put
all hosts that stand out into a block lists, but that seems to be an
infinite work.

Has someone configured something like "block all hosts for x minutes
that try to send emails to more than y not existing recipients" with exim?

Regards
Marten