How to block SMTP?

Question

Mikrotik

Good day, I'm trying to calculate SPAM mailings on the network. I launched torch in Mikrotik on the first WAN port and I see this picture:

There is silence on the second WAN port. As soon as I cut down WAN1, all traffic switches to WAN2, the picture in torch will be repeated as in the first case.
Tell me how can I generally block SMTP for everyone, and leave only certain users on Mikrotik?

Answer 1

block dst port 25 for all but a select few with the help of ip - firewall. In the same place, enable log and identify which address is infected.

Answer 2

Find and punish:
https://wiki.mikrotik.com/wiki/How_to_autodetect_i...