Have you considered some sort of scripting language (perhaps it is alreadythere???) that would allow you to be very aggressive and do something like the following: if a domain sends more 3 or more emails to bogus names at our domain within 1 minute (i.e. A directory harvest attack), then block that sender address or block that sender domain for a period of xx minutes.