Quoting Simon Arlott:
> Someone might find this useful, it tracks the most recent unique HELO
> names used per IP and the times they were last used - spam zombies
> become very obvious with this information.
Nice idea. I didn't look at the code, but at first glance I'd say the
same could already be done with Exim's builtin functions and some
database backend (e.g. sqlite as a simple one).