The max email per hour setting in tweak settings does not work properly. It seems its counting the number of email messages, not the number of recipients. Thus spammers are sending one email with hundreds of BCC's. Here is one entry from the mail queue Code: 1O7Huj-000Dxa-2i-H mailnull 26 6 <firstname.lastname@example.org> 1272502057 0 -helo_name braswell.fu8.com -host_address 127.0.0.1.49479 -host_name localhost -host_auth fixed_login -interface_address 127.0.0.1.25 -received_protocol esmtpa -body_linecount 78 -max_received_linelength 74 -auth_id [email]email@example.com[/email] YY [email]firstname.lastname@example.org[/email] YY [email]email@example.com[/email] *SNIP* continues for 500 addresses 500 [email]firstname.lastname@example.org[/email] [email]email@example.com[/email] *SNIP* continues for 500 addresses 217P Received: from localhost ([127.0.0.1] helo=braswell.fu8.com) by server4.hostultra.com with esmtpa (Exim 4.71 (FreeBSD)) (envelope-from <firstname.lastname@example.org>) id 1O7Huj-000Dxa-2i; Thu, 29 Apr 2010 00:47:37 +0000 194P Received: from 22.214.171.124 ([126.96.36.199]) (SquirrelMail authenticated user [email]email@example.com[/email]) by braswell.fu8.com with HTTP; Thu, 29 Apr 2010 00:47:37 -0000 073I Message-ID: <firstname.lastname@example.org> 038 Date: Thu, 29 Apr 2010 00:47:37 -0000 022 Subject: Job Position 050F From: "Jack V. Braswell" <email@example.com> 033R Reply-To: [email]firstname.lastname@example.org[/email] 032 User-Agent: SquirrelMail/1.4.20 018 MIME-Version: 1.0 044 Content-Type: text/plain;charset=iso-8859-1 032 Content-Transfer-Encoding: 8bit 023 X-Priority: 3 (Normal) 019 Importance: Normal In the users file in /var/cpanel/maxemailstracker 188.8.131.52=38 Would indicate the user sent 38 messages, but actually he sent thousands, apparently using BCC's in squirrelmail. Also. why is squirrel sending via SMTP now. It was much easier when it used sendmail and i could replace the sendmail binary with one that does additional checks.