In last days I'd faced with the same problem with compromised account. Is it possible with fail2ban to count connections per user and if there is huge amount of connections from different IP's for a small period of time to add it in iptables ?
I agree with riverco in that counting connections is probably not the desired approach.
Here is the system which we have used quite successfully.
Use Fail2ban to block FAILED connection attempts. This will take care of brute force attacks against your mail/web surfaces.
In Fail2ban, manually white list customer IPs for their office where a large number of users access your mail system from a single location. This will prevent one errant user from blocking everyone in their company when they get a new device and can't remember their email password.
Monitor the Sent message count over a specific relatively short time period in the Amavisd database. For this we use a custom Python script run via cron. A compromised account will invariably show a spike in outbound message traffic. Spammers are all about volume and are very impatient.
Ensure that you are following RFCs by enabling and monitoring the ABUSE and POSTMASTER addresses. We set these up as aliases for our own mail admin for every mail domain we host. If everything else is configured properly, you will have near zero traffic to your admin addresses - except when you have a problem. If an account were to be compromised and was sending a slow, steady stream of spam to avoid the amavisd monitor, you would receive reports back and can take manual action.
Automatically disable compromised accounts by running the monitor frequently via cron.
Ensure that the amavisd database is kept cleaned out to prevent the monitor from becoming an expensive test and slowing your entire system down. Zhang Huangbin has posted the scripts to do this effectively.
Use qshape to especially monitor the Deferred queue. A spike in the deferred queue is typically a sign of a compromised account. Qshape is your best friend in monitoring the health of your mail system. We have cron jobs which send regular reports to our mail admins and monitor it manually frequently when there appear to be performance or other mail issues. As a side note, qshape is very cheap to run. It would be nice if this were part of the iRedAdminPro dashboard stats. Our cron jobs print out the current Active, Incoming, Hold and Deferrred Queue and then print the top senders in the deferred queue.
Manually inspect the top sender list at least daily in the iRedAdmin Pro panel so you can watch for unusual traffic patterns.
We try to automate as much of the monitoring process as we can, given that we get busy with other tasks and have better things to do with our work day than manually watch mail logs. This model has worked very well for us thus far.