What I have been watching of late if the connections window.

Any host that has a high message to time ration I kill. A good server will send around 1500 to 2000 messages per hour.

When you get one that sends 1000 in the first few minutes, you are pretty much guaranteed spam

I also take a note of the ip address and when I start to see multiples with similar IP address I block the lower ranges of them. IE 72,74,*,*.

Maybe there should be a database with all the IP's people block. That could be used to zero out the spammers pretty well.

I know there are a lot of address starting with 24.*.*.* and 72.*.*.* that give a lot of spam in searches.