We have had a number of user accounts compromised - due mainly to users clicking on SPAM links -

Is it possible to create an alert script, to tell us if a user account sent more than a specific (large) amount of e-mails in a set time frame (say 1~2hrs)
this could act as an early warning that a user account has been compromised.