Hmm, here's an option.  You can decide whether it would be worth it for you.  You can enable keyword filtering to scan all mail headers of the message using this option in SpamFilter.ini:

ScanAllHeaders=1

However, you may want to make sure that any existing keywords would not accidentally block "good" mail headers.

After your keyword filter is scanning all headers, you may be able to block odd helo domains using this RegEx keyword (but see warning below)

((?i)x-sf-helo-domain: [^.]+$)

A couple reasons to be careful with the keyword above...

• I didn't test it.  I probably should have, but I'm in a rush today.
• It's a very loose keyword - it will block any declared helo domain that does not have a dot "." (or full stop) in it.
• In my experience some good (but lazy) mail senders do not send valid statements in their helo commands.  You will have to monitor your blocked mail, and make adjustments to the keyword to accommodate good servers with weird HELOs.

Good luck!

Stephen