Such a feature exists already.

Recently, our copy of Horde/Imp became a spam launch platform when a 
spammer managed to compromise an authentication.



The Horde logging is excellent and provides all the necessary 
information. So I plan to write a script to parse the log and count 
things like number of failed authentications and number of recipients 
over a span of time; and somehow tie it all into Nagios.



However, it does seem to me that it would not be hard to add "spammer 
detection" to the Imp tool suite.



thank you for your time.