Check "Parmacy", "Parmacist" etc. email which has sent over 30 msgs within the last 24 hours.
mysql> select subject, remote_hostname, inet_ntoa(remote_ip), count(remote_ip) from messages where subject like '%pharm%' and timestamp > unix_timestamp(date_sub(now(), interval 1 day)) group by subject having count(remote_ip) > 30;
Why do it need it?
Some users do not enjoy free anti-spam service. And yet, mbox-full bouncing email causes some spamcop complain issue