Re: [exim] identifying compromised accounts

On 07/11/14 19:13, Patrick von der Hagen wrote:
> Hi all,
>
> I've been having issues with compromised accounts used to send spam via
> authenticated connections to my servers. Don't ask me how those people
> lost their passwords, but they did.

You can play with ratelimit entries to spot an unusual increase in
send rate, per account.

You can watch for rate of rejects, rather than bounces (please don't
say you accept-then-bounce!)

You can charge your customers real money in cleanup fees.
--
Cheers,
Jeremy