I'd like to provide you complex solution how to fight with attack and predict them. I implemented fail2ban and integrated DoS filter of Zimbra to defeat of attack on the mail server. Client's server was attacked, and one email account was hacked. Hackers sent a lot of email 2 days. The server was added to blacklists and client had email from ISP provider that it has complaint from other clients and solve urgent the issue the spam from your server.
So, I will give you some advice how to avoid such situation and how to set your server from attack.
