[imp] tools for monitoring outbound spam

[liamr at umich.edu]

Like many other institutions, we've got a problem with compromised 
accounts being used to send spam.  I know that the new version of Horde 
/ IMP will allow people to place limits on outbound mail... but there 
is some concern in our organization that those methods will create 
problems for some legitimate users.

Anyhoo.. I was wondering if anyone has written tools to monitor their 
sendmail logs / webserver transfer logs for suspicious activity (or for 
noticing that their servers have been added to RBLs).  Or if anyone is 
using tools that do these things, or would be interested discussing the 
development of tools or strategies

thx
Liam