Because I’m such a geek, I almost always have a “tail -F” of various logs going by. That includes the procmail logs of most of the people with accounts on this system – I don’t consider that a privacy violation because all I see is subject lines, and it helps me make sure their spam filters are working well.
My step daughter is a senior in high school, so she’s getting a lot of email from colleges. The spam filters were catching some of this as spam, so I put in by-passes for anything coming from a college (and you’d be surprised how many of them don’t use a .edu for their recruiting stuff).
Today I saw three messages in a row from some college, all with the same subject line. A little grepping in her procmail log, and found that they’d sent her 24 messages, all with the same subject. Just then I heard her exclaim “Another 9 from these guys” as she checked her email. I asked if she wanted me to screen them out, and she said yes. So I put them in /etc/postfix/access, and while they’re still sending them every 10 minutes like clockwork, now they’re getting 554 responses.
UPDATE: They apparently stopped their every 10 minutes spam run at 4:29 this morning, but then they sent 65 more spams between 10:18 and 10:23.