> If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case. I have * `exim-usernames` - 10 day ban instantly for anyone t

> If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case. I have * `exim-usernames` - 10 day ban instantly for anyone trying to login with a specific set of usernames (227 currently banned) * `exim-aggressive` - 4h ban for repeated failures (SSL, EHLO, etc.) (7 currently banned) * `exim-spam` - 4h ban for repeated spam rejections. (0 currently banned) Plus `rspamd` for greylisting, honeypot addresses, etc.