I handled this particular issue without using a drop rule because it was easier when reviewing logs. I simply changed the source IP in the "System Rule: Client Exploit - Mass Mailing Worm" from "ANY" to "!=".
So I don't know if this will work in your situation, but if you're only trying to exclude your mail servers, just list them all as exceptions in your inspection rule. You'll find that not only will those connections no longer trigger an incident, they will also not be logged as "mass mailing worm" events.
