Best Practice for stopping unsolicited e-mails that are not detected as SPAM or Marketing?

Question

I have roughly 40,000 mailboxes behind some IronPort appliances.   My question for all of you veteran SMTP admins is how do you handle situations where you have an individual sending multiple e-mails to one of your mailboxes?  It's not really a big enough of an issue to setup a content filter for the sending e-mail address, we don't have Blocklists roled out to everyone yet, so that's not a good fit, although I really like the IronPort quarantine with it's SafeList and Blocklist features.
What I'm looking for is do you even take the time to try to work with the sender and get them to stop sending the e-mails?
Do you bounce the e-mails back to the sender?
Setup a client side (Outlook) rule to just automatically delete the e-mails?
Just looking for some "best practice" or good advice on how to handle these minor issues.  The major ones are easy but it's these little ones that turn into administrative issues.
Thanks all, look forward to your input...
Jason Meyer

Answer 1

If the sender is mailbombing you (sending a large number of mails just to flood your mailbox) then that's clear network abuse; you ignore him and complain to his system administrator or to his upstream provider. As that's likely to take some time if it works at all, you also want a block in place as soon as you've recorded enough evidence to document the abuse.
There used to be a vulnerability in MS Small Business Server whereby some chump would send out a mail to over 500(?) recipients including at least two SBS boxes with the bug. Each box would then send a further copy of the mail, thereby creating a loop. Swift coding was necessary to protect one's own recipients from the deluge. (And that's a sales argument in favour of appliances versus outsourcing to the Cloud, by the way.) Strictly speaking, the abuse was the fault of the SBS systems administrators rather than the original chump, so careful header parsing can sometimes be necessary.
A more likely scenario is that you have someone who just keeps on sending the odd spam, week after week. Let's take the worst case; that it's addressed just to you, the sender's domain is reasonably fragrant (or at least impractical to block) and there's no headers or body phrases that you can add to a filter to create a general solution. You have to block the specific sender.
At the moment I'm doing this with a simple dictionary-driven rule. If I get a complaint from any of my mailbox owners and am satisfied that nothing else will workthen I simply add the sender's address to the dictionary. The rule is already in place and only requires a dictionary update. One hallmark of this type of case is that I have no qualms about simply dropping the mail, rather than sending some sort of NDR.
Sender-blacklist: if (mail-from-dictionary-match("blocked-senders", 1)) { drop(); }
Now at the scale you are discussing, this solution may not work. Is there time to properly examine each case, or will your colleagues simply start slamming addresses into such a dictionary? How quickly will the list grow to the point where it starts to consume an unreasonable slice of your CPU time? Indeed, I'm not sure how far such a solution will scale even if processing capacity is not an issue.
I need a review process to remove addresses from my dictionary, but then the same principle applies to any filter that uses specific static data. I try to keep records of every case where I include such data, and if I cannot find justification for a specific listing then I remove it at once.