Fortunately I started this endeavor back before Microsoft even knew what a mail server was, so I’ve been at it awhile. Some changes have been reactionary to attacks, other changes have been simply keeping up with practices where I could. I do what I can though.
Yeah someone else mentioned whitelisting but with connections like your cell phone picking up IPs all over the place, while simultaneously being the source of other attacks, it’s just not as feasible for this. Of course I do have blocklists against spam sources and such, plus a dedicated firewall in front of everything, but I somehow missed blocking the easy targets against compromised accounts.
As for my friend… yeah it wasn’t even happening from his laptop, it was just the fact that he had logged in to his account and the virus recorded his password. After that first moment of rage (assuming he fell for a phishing attack), I scrambled his password, flushed all the emails from the queue, and then started cleaning things up. So far it looks like I was only temporarily blacklisted, and those cleared up about an hour after I shut down the spam. Now I’m just keeping a close eye on things to make sure nobody else comes through on that account.