Flood emails with the same source
It would be interesting some blocking method for e-mail sended from a same address in a small space of time.
Eg: the address firstname.lastname@example.org sends 1000 email to the protected domain on UTM in 2 seconds.
Remembering that this would not apply to the whole domain but to an speciffy address.
This would be interesting when an email box is hacked and used to send many spams.