What patterns are you getting in, and what mailer are you using, if its exim it would be most likely simple, most of the times just one regexp. But please post the patterns so we know what it looks like.
Are they open proxy's? Please check some IPs on www.dsbl.org that you are getting in.
Today I've ha 4 of them so far, in the past few hours all coming from 66.205.22.52 .91 .66 and .65 none of which are listed as open proxies by www.dsbl.org
Couple nights ago I had an outright DoS attack by 15 different places doing dictionary attacks.
Any suggestions on something I can run? Oh and using Sendmail 8.12.11 the latest version and I do have it throttled down but still not helping.
-Doc