How to identify the fact of hacking a user's mailbox?

Question

postfix

There is a postfix + dovecot + spamassassin mail server. Periodically, by brute force, they select a password for mailboxes. After several hacking facts, the following parameters were configured

1. anvil_rate_time_unit 24h
   
2. smtpd_client_message_rate_limit 1000
   

The number of sent letters and the chippers that came to them has been significantly reduced. But at the same time, it has now become more difficult to record the facts of hacking.

Is it possible to notify mail server administrators about reaching the limit of sent emails for a given period?

Answer 1

Set fail2ban to monitor the mail log and ban those IPs from which more than 5-10 incorrect login attempts per minute were made.

Answer 2

It's not pretty, but it's stupid to parse the log and count the necessary numbers. After analyzing the numbers, send a letter to the admins.