0

watch for the 5xx

just in case you want to identify some bad guys, using your mail infrastructure for sending out spam… often these guys use bad recipient lists, that produce 5xx user unknown responses. count per timespan is a pretty good indicator.