One of the customer email account as getting too much incoming emails from random-user@qq.com.
First i tried to block the sender IP, but they are using too many IP.
To stop this incoming email, i edited
vi /etc/exim.conf
Find
acl_smtp_rcpt
Add below
deny message = SPF: $sender_host_address is not allowed to send mail from $sender_address_domain spf = fail
Restart exim
service exim restart
Now watch the mail log with
tail -f /var/log/exim_mainlog | grep "is not allowed to send mail from"
bz=1.01&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=1837