Looking at this on rate-limiting:
http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTratelimiting
I have this in exim.conf
warn ratelimit = 1000 / 12h / per_rcpt / strict
delay = 10s
log_message = Sender $sender_address rate $sender_rate /
$sender_rate_period excedes limit delayed 10 seconds
Works well to stop virus infected PC's in the IP pools I relay for.
Since all webmail comes from 127.0.0.1 it does not work very well for
that. I have webmail locked down so as they cannot change there
source email address. Is there a way with ratelimit I can add a
second rule for 127.0.0.1 that ratelimits be source email address
instead of just source IP?