locked mailbox

[siteffect]

Hi all, we are continiously having locked mailboxes due to intrusion attempts.
Is there any quick way to see why a mailbox has been locked ? i know it's due to 3 failed login attemps, but can I easily find what IP actually locked the mailbox ?
I looked through the pop / smtp / imap log files, but this is not easy. Any tool available or maybe a suggestion for future versions to have a button next to the unlock mailbox button to see why it was locked (with details of failed attempts) ?
thanks

[rfwilliams777]

If you can track down the IP address or better yet a group of the same IP addresses, you can set up a windows firewall to block a whole class C or even higher. However, please note that if you attempt to block valid IP addresses of servers or people who use your services (for example your server is in the US, you send/receive often in the US, your users are in the US, and the hackers are in the US) then you may do a false block.

[cfdynamics]

We like to use the other abuse prevention option. It blocks the IP being used for a temporary amount of time instead of locking the mailbox. this makes it so the actual owner of the mailbox does not get blocked.

[siteffect]

can you tell me how & where you change that option ?

[MailEnable-Ian]

Hi,

can you tell me how & where you change that option ?

http://www.mailenable.com/documentation/9.0/Enterprise/Localhost_-_Policies.html - Abuse detection and prevention option

[siteffect]

is there any way we can see Who actually locked a mailbox ? Which IP, Which Login, What time ?
Thanks, this would be a big help

[siteffect]

we found that this line is entered in the NAME.sys file under postoffices Auth-Failure-Count:
is there any way this can also be written in a separate file under the logging directory ?
In this case we can easily detect what mailboxes are locked at any given moment and found potential hack attempts much quicker.