[exim] Rate limiting

I have been experimenting some with rate limiting. We like so many
others are plagued by compromised accounts spewing spam.

It seems that many of the examples show setups that track clients
rather than users. This does not help much where our webmail machines
run the MTA on the same host so all clients are 127.0.0.1.

What I really want is the ability to log when
compromised_account@??? sends one message to more than x rcpts.

I've been googling but no joy yet. Can any one point me to a tutorial?
Using Exim 4.63

Thanks
/sd




Steve Devine