Peter <occassionally-confused@nospam.co.uk> wrote:
You could try fail2ban and a custom set of rules to monitor the mail
log

http://www.fail2ban.org/

From the website: Fail2ban scans log files like /var/log/pwdfail or
/var/log/apache/error_log and bans IP that makes too many password
failures. It updates firewall rules to reject the IP address.

And here is someone who has got fail2ban to monitor sendmail logs as
well.

http://www.the-art-of-web.com/system/fail2ban-sendmail/

I've not tried the mail monitoring bit, but fail2ban works very well
for ssh scans in my experience.

--
Nick Craig-Wood <nick@craig-wood.com> -- http://www.craig-wood.com/nick