After managing systems running his tools in the past (circa 1990s-2000s) I came to the sad realisation that a lot of the "security" for qmail in particular was

After managing systems running his tools in the past (circa 1990s-2000s) I came to the sad realisation that a lot of the "security" for qmail in particular was "deny that certain circumstances were happening" - as in do not log, do not report, leave as little trace as possible when a server was hijacked by spammers. Spammers sure didn't have a problem using it. Following SMTP spec as closely as qmail did made it really easy to be a spam redirector, sadly, and very very hard to secure. And pretty much no protection at all for clients, regardless of how many viruses were present in the mail itself. I usually switched to postfix as it was low grief switch (good support for the same file layouts) - and much easier to harden. (I did use sendmail for a while - it's doable, just time consuming to work with. postfix was also a happier switch there). I never did find an alternative worth anything and have since retired from running email at all, instead paying for third party hosting.