(Sr. Net Eng at $ISP) Netflow data is extremely helpful, although not on its own (it will also identify legitimate customers running their own mail servers). I

(Sr. Net Eng at $ISP) Netflow data is extremely helpful, although not on its own (it will also identify legitimate customers running their own mail servers). It's a good start, though.