Thank you all for your responses
Going through the customers files isn't kosher and should never been seen as a 'good idea'.Using putty.exe, if I enter this short script
grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
iptables -A FORWARD -p tcp --dport 25 -s IP -j DROP